SolarWinds Patch Manager contains a sensitive information disclosure flaw that allows a local user to read protected data. The exposed information can be leveraged to elevate privileges, potentially giving an attacker root or administrative level access. The underlying weakness is an information disclosure vulnerability identified as CWE-200.

The vulnerability affects SolarWinds Patch Manager. All released versions prior to Patch Manager 2026.4 are vulnerable because the flaw exists in the default configuration and is not mitigated except by upgrading. No specific sub‑version range is listed, so any deployment of Patch Manager before the 2026.4 update should be considered at risk.

The CVSS score of 4.4 denotes a moderate risk. Because the flaw requires local user access, exploitation is limited to environments where an attacker can leverage an existing user account. EPSS is unavailable, and the vulnerability is not catalogued in CISA’s KEV list, indicating that no widespread active exploits are currently known. However, once a local account is compromised, the attacker can read sensitive data and use it to elevate privileges, so the risk is non‑negligible.