SolarWinds vulnerabilities

CVEs per yearBy the year they were published

1. 20201
2. 202141
3. 202224
4. 202345
5. 202444
6. 202521
7. 202642

Known exploitedNewest addition to KEV first

• CVE-2026-28318

  SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability

  SolarWinds · Serv-U

  ExploitedHigh7.5
• CVE-2025-26399

  SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability

  SolarWinds · Web Help Desk

  ExploitedCritical9.8
• CVE-2025-40536

  SolarWinds Web Help Desk Security Control Bypass Vulnerability

  SolarWinds · Web Help Desk

  ExploitedHigh8.1
• CVE-2025-40551

  SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

  SolarWinds · Web Help Desk

  ExploitedCritical9.8
• CVE-2024-28987

  SolarWinds Web Help Desk Hardcoded Credential Vulnerability

  SolarWinds · Web Help Desk

  ExploitedCritical9.1
• CVE-2024-28986

  SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability

  SolarWinds · Web Help Desk

  ExploitedCritical9.8
• CVE-2024-28995

  SolarWinds Serv-U L Directory Transversal Vulnerability

  SolarWinds · SolarWinds Serv-U

  ExploitedHigh8.6
• CVE-2021-35247

  Improper Input Validation Vulnerability in Serv-U

  SolarWinds · Serv-U

  ExploitedMedium4.3
• CVE-2021-35211

  Serv-U Remote Memory Escape Vulnerability

  SolarWinds · Serv-U Managed File Transfer Server and Serv-U Secured FTP

  ExploitedCritical9.0
• CVE-2020-10148

  SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands

  SolarWinds · Orion Platform

  ExploitedCritical9.8

Newest CVEs

• CVE-2026-28336

  SolarWinds Dameware Command Injection Vulnerability

  SolarWinds · Dameware

  Critical9.9
• CVE-2026-28335

  SolarWinds Dameware Buffer Overflow Vulnerability

  SolarWinds · Dameware

  High8.4
• CVE-2026-28327

  SolarWinds Dameware DLL Hijacking Vulnerability

  SolarWinds · Dameware

  High8.2
• CVE-2026-28330

  SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability

  SolarWinds · SolarWinds Observability Self-Hosted

  Medium4.6
• CVE-2026-28329

  SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF)

  SolarWinds · SolarWinds Observability Self-Hosted

  Medium6.4
• CVE-2026-28328

  SolarWinds Observability Self-Hosted broken authorization schema

  SolarWinds · SolarWinds Observability Self-Hosted

  High8.8
• CVE-2026-28331

  SolarWinds Patch Manager Sensitive Information Exposure Vulnerability

  SolarWinds · Patch Manager

  Medium4.4
• CVE-2026-28325

  SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability

  SolarWinds · Observability Self-Hosted

  High8.8
• CVE-2026-28324

  SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability

  SolarWinds · Observability Self-Hosted

  Critical9.8
• CVE-2026-28326

  SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability

  SolarWinds · Access Rights Manager

  High8.8