[ Vendor · 23 CVEs ]
SolarWinds
CVEs affecting SolarWinds published in the last 30 days, plus any SolarWinds CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-28329 | 20 Oct 2026 | CVSS 6.4 | SolarWinds Observability Self-HostedSolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated… | Fix |
| CVE-2026-28330 | 20 Oct 2026 | CVSS 4.6 | SolarWinds Observability Self-HostedSolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated… | Fix |
| CVE-2026-28331 | 20 Oct 2026 | CVSS 4.4 | SolarWinds Patch ManagerSolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges. | Fix |
| CVE-2026-28328 | 20 Oct 2026 | CVSS 8.8 | SolarWinds Observability Self-HostedSolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and… | Fix |
| CVE-2026-28325 | 22 Sep 2026 | CVSS 8.8 | SolarWinds Observability Self-HostedSolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization… | Fix |
| CVE-2026-28324 | 22 Sep 2026 | CVSS 9.8 | SolarWinds Observability Self-HostedSolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient… | Fix |
| CVE-2026-28308 | 21 Jul 2026 | CVSS 9.1 | SolarWinds Serv-USolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain… | Fix |
| CVE-2026-28318 | 4 Jun 2026 | CVSS 7.5 | SolarWinds Serv-U Uncontrolled Resource ConsumptionSolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding… | Exploited |
| CVE-2025-40551 | 28 Jan 2026 | CVSS 9.8 | SolarWinds Web Help Desk Deserialization of Untrusted DataSolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution… | Exploited |
| CVE-2025-40536 | 28 Jan 2026 | CVSS 9.8 | SolarWinds Web Help Desk Security Control BypassSolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated… | Exploited |
| CVE-2025-26399 | 23 Sep 2025 | CVSS 9.8 | SolarWinds Web Help Desk Deserialization of Untrusted DataSolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if… | ExploitedFix |
| CVE-2024-28987 | 21 Aug 2024 | CVSS 9.1 | SolarWinds Web Help Desk Hardcoded CredentialThe SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access… | Exploited |
| CVE-2024-28987 | 21 Aug 2024 | CVSS 9.1 | SolarWinds Web Help Desk Hardcoded CredentialThe SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access… | Exploited |
| CVE-2024-28986 | 13 Aug 2024 | CVSS 9.8 | SolarWinds Web Help Desk Deserialization of Untrusted DataSolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an… | Exploited |
| CVE-2024-28986 | 13 Aug 2024 | CVSS 9.8 | SolarWinds Web Help Desk Deserialization of Untrusted DataSolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an… | Exploited |
| CVE-2024-28995 | 6 Jun 2024 | CVSS 7.5 | SolarWinds Serv-U Path TraversalSolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine. | Exploited |
| CVE-2024-28995 | 6 Jun 2024 | CVSS 7.5 | SolarWinds Serv-U Path TraversalSolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine. | Exploited |
| CVE-2021-35247 | 10 Jan 2022 | CVSS 5.3 | SolarWinds Serv-U Improper Input ValidationServ-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input… | Exploited |
| CVE-2021-35211 | 14 Jul 2021 | CVSS 10.0 | SolarWinds Serv-U Remote Code ExecutionMicrosoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If… | ExploitedFix |
| CVE-2020-10148 | 29 Dec 2020 | CVSS 9.8 | SolarWinds Orion Authentication BypassThe SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability… | Exploited |
| CVE-2020-10148 | 29 Dec 2020 | CVSS 9.8 | SolarWinds Orion Authentication BypassThe SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability… | Exploited |
| CVE-2016-3643 | 17 Jun 2016 | CVSS 7.8 | SolarWinds Virtualization Manager Privilege EscalationSolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by… | Exploited |
| CVE-2016-3643 | 17 Jun 2016 | CVSS 7.8 | SolarWinds Virtualization Manager Privilege EscalationSolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by… | Exploited |