# CVE-2016-3643: SolarWinds Virtualization Manager Privilege Escalation Vulnerability

Source: https://junglewise.ai/threats/cve-2016-3643-solarwinds-virtualization-manager-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-11-03. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2016-3643 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2021-11-03

SolarWinds Virtualization Manager 6.3.1 and earlier contains a privilege escalation vulnerability due to a misconfiguration of sudo. Local users can exploit this to gain elevated privileges, as demonstrated by executing commands like 'sudo cat /etc/passwd'.

Vendors: [SolarWinds](https://junglewise.ai/threats/vendors/solarwinds).

## Quick answers

**Is CVE-2016-3643 exploited in the wild?** Yes. CVE-2016-3643 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.

**How severe is CVE-2016-3643?** Critical severity, with a CVSS score of 7.8, published 3 November 2021.

**Which products and versions are affected?** SolarWinds Virtualization Manager 6.3.1 and earlier.

**Is there a fix for CVE-2016-3643?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2016-3643 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2016-3643?** Check whether you run SolarWinds Virtualization Manager. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- SolarWinds Virtualization Manager 6.3.1 and earlier

## Timeline

- 2016-06-17: disclosed: NVD Published Date
- 2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog