SolarWinds vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited SolarWinds flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource ConsumptionExploited since Jun 5, 2026 · CVSS 7.5
• CVE-2025-26399 SolarWinds Web Help Desk Deserialization of Untrusted DataExploited since Mar 9, 2026 · ransomware · CVSS 9.8
• CVE-2025-40536 SolarWinds Web Help Desk Security Control BypassExploited since Feb 12, 2026 · CVSS 8.1
• CVE-2025-40551 SolarWinds Web Help Desk Deserialization of Untrusted DataExploited since Feb 3, 2026 · CVSS 9.8
• CVE-2024-28987 SolarWinds Web Help Desk Hardcoded CredentialExploited since Oct 15, 2024 · CVSS 9.1
• CVE-2024-28986 SolarWinds Web Help Desk Deserialization of Untrusted DataExploited since Aug 15, 2024 · CVSS 9.8
• CVE-2024-28995 SolarWinds Serv-U Path Traversal Vulnerability Exploited since Jul 17, 2024 · CVSS 8.6
• CVE-2021-35247 SolarWinds Serv-U Improper Input ValidationExploited since Jan 21, 2022 · CVSS 4.3
• CVE-2021-35211 SolarWinds Serv-U Remote Code ExecutionExploited since Nov 3, 2021 · ransomware · CVSS 9
• CVE-2020-10148 SolarWinds Orion Authentication BypassExploited since Nov 3, 2021 · CVSS 9.8
• CVE-2016-3643 SolarWinds Virtualization Manager Privilege EscalationExploited since Nov 3, 2021 · CVSS 7.8

Latest high and critical flaws

• CVE-2026-28328 SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify informatHigh 8.8 · Oct 20, 2026
• CVE-2026-28325 SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrustHigh 8.8 · Sep 22, 2026
• CVE-2026-28324 SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checksCritical 9.8 · Sep 22, 2026
• CVE-2026-28326 SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability.High 8.8 · Sep 17, 2026
• CVE-2026-28323 SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability.Critical 9.8 · Jul 30, 2026
• CVE-2026-28321 SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privilCritical 9.1 · Jul 21, 2026
• CVE-2026-28317 SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation.Critical 9.1 · Jul 21, 2026
• CVE-2026-28316 SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with tCritical 9.1 · Jul 21, 2026
• CVE-2026-28314 SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover.Critical 9.1 · Jul 21, 2026
• CVE-2026-28313 SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover.Critical 9.1 · Jul 21, 2026
• CVE-2026-28312 SolarWinds Serv-U is affected by a privilege escalation vulnerability.Critical 9.1 · Jul 21, 2026
• CVE-2026-28310 SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system adminisCritical 9.1 · Jul 21, 2026
• CVE-2026-28309 SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts.Critical 9.1 · Jul 21, 2026
• CVE-2026-28308 SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution.Critical 9.1 · Jul 21, 2026
• CVE-2026-28307 SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group.Critical 9.1 · Jul 21, 2026
• CVE-2026-28306 SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator.Critical 9.1 · Jul 21, 2026
• CVE-2026-28305 SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root.Critical 9.1 · Jul 21, 2026
• CVE-2026-28304 SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root.Critical 9.1 · Jul 21, 2026
• CVE-2026-28302 SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as rooCritical 9.1 · Jul 21, 2026
• CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource ConsumptionExploited · High 7.5 · Jun 4, 2026
• CVE-2026-28299 SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due tHigh 8.2 · Jun 2, 2026
• CVE-2025-40541 An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as aCritical 9.1 · Feb 24, 2026
• CVE-2025-40540 A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged accountCritical 9.1 · Feb 24, 2026
• CVE-2025-40539 A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged accountCritical 9.1 · Feb 24, 2026
• CVE-2025-40538 A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitCritical 9.1 · Feb 24, 2026