Yes. CISA added CVE-2016-3643 to its Known Exploited Vulnerabilities catalogue on 3 November 2021, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. SolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo. Any organisation running the affected product should treat remediation as urgent.
What “exploited in the wild” means for this CVE
For this CVE, “exploited in the wild” means the issue is not just theoretically dangerous, it has been observed often enough for CISA to add it to the Known Exploited Vulnerabilities catalogue. That shifts the question from “should we patch eventually?” to “are we exposed right now, and can an attacker still reach the vulnerable path?”
Because the flaw is a privilege escalation in SolarWinds Virtualization Manager, the practical concern is whether a low-privileged foothold inside the product can be converted into higher privileges on the host or adjacent systems. When a vulnerability is already being used actively, CISA KEV becomes the priority signal, and the product should be treated as an urgent remediation item rather than a routine hardening task.
If you need a broader method for handling actively exploited flaws, the Zero-Day and Exploited Vulnerabilities Guide covers the operational logic behind KEV triage, emergency mitigation, and post-patch hunting.
Why the misconfigured sudo path matters
The direct risk is not only the existence of a bug, but the trust placed in the local administration path that sudo represents. If sudo is misconfigured, privilege boundaries can collapse from “service or user context” into “administrator context,” which makes the flaw attractive once an attacker has any access to the system that hosts the product.
The key operational issue is that privilege escalation often leaves a smaller footprint than full remote compromise. An attacker may not need to replace the application, only abuse its allowed command path or configuration relationship to gain elevated execution. That is why active exploitation of privilege-escalation flaws can be especially dangerous in management tooling and other systems with broad operational reach.
For teams trying to understand the escalation pattern itself, Privileged Access Management Guide is useful because it frames how standing privilege, session control, and break-glass access should be constrained when a system can be turned into a privilege boundary bypass.
What to do before and after remediation
First confirm whether SolarWinds Virtualization Manager is present anywhere in the environment, including test, standby, and forgotten administrative servers. Then verify whether any account or service interacting with it has elevated local permissions, because the practical exposure is often larger than the product inventory suggests. If the system is internet reachable or reachable from a broad internal admin network, assume the exposure window is meaningful until proven otherwise.
If patching or replacement cannot happen immediately, isolate the host, restrict administrative access to the narrowest possible management path, and review whether the product’s local privilege model can be reduced without breaking operations. Where a privilege-escalation flaw has been exploitable, also check logs, scheduled tasks, sudo activity, new local users, unexpected binaries, and unusual outbound connections for signs of earlier compromise.
The most useful companion control question is whether your privilege model still assumes that a management server is “trusted by default.” Vulnerability Management Guide is a practical reference for confirming exposure, setting remediation urgency, and deciding what evidence to retain after patching.
Risk and Threat Considerations
Actively exploited privilege-escalation flaws are high-risk because they convert a partial foothold into broader control. In a management product, that can mean the attacker moves from application access into operating-system-level control, which expands the blast radius beyond the product itself.
Failure mechanism: A misconfigured sudo path allows the product or a related local context to invoke privileged actions that should not be reachable by the attacker’s starting privilege level.
Impact: An attacker who reaches the vulnerable path can escalate privileges, tamper with the host, disable defenses, or use the server as a pivot point for lateral movement and persistence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack surface, CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Active exploitation makes exposure confirmation and fast remediation central. |
| Recommendation — Prioritise, track, and remediate KEV-listed vulnerabilities on exposed assets. | ||
| NIST SP 800-53 Rev 5 | SI-2 — Flaw Remediation | This CVE requires urgent flaw remediation and verification of fixed status. |
| Recommendation — Track the flaw to remediation and validate that affected systems are updated. | ||
| MITRE ATT&CK | T1068 — Exploitation for Privilege Escalation | The issue is a privilege-escalation path that attackers can abuse after foothold. |
| Recommendation — Hunt for privilege-escalation activity and verify host controls that block elevation. | ||
| NIST CSF 2.0 | PR.PS-03 — Vulnerability Management | KEV-listed exploitation maps to prioritised vulnerability remediation and exposure reduction. |
| Recommendation — Use vulnerability management to prioritize and remediate exploited software quickly. | ||
| ISO/IEC 27001:2022 | A.8.8 — Management of technical vulnerabilities | The subject is an actively exploited vulnerability requiring controlled remediation. |
| Recommendation — Identify, assess, and remediate technical vulnerabilities according to risk. | ||
Practitioner Guidance
What to prioritise: Treat confirmed KEV status as a remediation trigger, not a prioritisation input. If the product exists on any business-critical or management-facing host, move it ahead of ordinary vulnerability backlogs.
What to verify: Confirm whether the installed instance is still in service, whether the vulnerable privilege path is reachable in your deployment, and whether any privileged local actions occurred before remediation. If you cannot verify those points quickly, assume exposure remains.
Practitioner takeaway: Once a flaw is in KEV and can elevate privilege, the real decision is not whether it is serious, it is whether you can still trust the host to be clean enough to keep running.
Related resources from NHI Mgmt Group
- CVE-2016-3643 (SolarWinds Virtualization Manager Privilege Escalation)
- Is CVE-2016-0165 (Microsoft Win32k Privilege Escalation) being exploited in the wild?
- Is CVE-2020-0638 (Microsoft Update Notification Manager Privilege Escalation) being exploited in the wild?
- Is CVE-2019-1315 (Microsoft Windows Error Reporting Manager Privilege Escalation) being exploited in the wild?