Uptime Report Research · Exploitation Ledger
SolarWinds Vulnerabilities: 43 CVEs in 2026 and 4 Added to CISA KEV, the Most in Any Year
As of November 13, 2026, NVD lists 338 SolarWinds vulnerabilities, 43 of them published this year (against 16 by the same date in 2025). CISA’s KEV catalog holds 11 SolarWinds CVEs as exploited, and 4 were added in 2026, the most in any year. Web Help Desk has 5 of them; Serv-U has 4.
338SolarWinds CVEs in NVD, 2001 to Nov 13, 2026
43published in 2026, 25 of them CVSS 9.0+
11in CISA KEV; 2 flagged for ransomware use
4KEV additions in 2026, a record for SolarWinds
Key findings
- NVD lists 338 CVEs in products SolarWinds sells or sold, not counting 12 in N-able products spun off in 2021. 43 were published from January 1 to November 13, 2026, against 16 in the same window of 2025 and 42 in 2024.
- CISA added 4 SolarWinds CVEs to its Known Exploited Vulnerabilities catalog in 2026, more than in any earlier year (3 in 2021, 1 in 2022, 3 in 2024).
- Web Help Desk accounts for 29 of the 338 CVEs (9%) but 5 of the 11 KEV entries. One of them, CVE-2025-26399, is SolarWinds’ own description of a patch bypass of a patch bypass, and CISA flags it for known ransomware use.
- Since the KEV catalog launched, the median SolarWinds CVE reached KEV 14.5 days after its first CVE record. 3 of those 8 were listed within a week, and CVE-2026-28318 in 1 day.
- 2026 has the most critical SolarWinds CVEs of any year: 25 at CVSS 9.0 or higher. But 18 of the 25 need an admin-level login under SolarWinds’ own CVSS vector; 6 need no login at all.
- 10 of the 11 exploited SolarWinds CVEs need no login under their CVSS vector; the exception is CVE-2016-3643, a local sudo flaw in Virtualization Manager.
- The 2020 SUNBURST attack is not a CVE. It was malicious code shipped in Orion updates from March to June 2020. The only Orion CVE in KEV, CVE-2020-10148, is an API authentication bypass disclosed December 29, 2020.
Latest SolarWinds vulnerabilities (June to November 2026)
30 SolarWinds CVEs were published from June 1 to November 13, 2026. The newest batch, on November 3, is three Dameware flaws led by CVE-2026-28336 (CVSS 9.9, command injection that SolarWinds says can compromise the remotely controlled host, with authentication required). On July 21 SolarWinds published 15 Serv-U CVEs in one day, 14 of them scored 9.1. Fixed versions below are the ones SolarWinds names in each CVE record.
| Published | CVE | Product | Issue (SolarWinds title) | CVSS | Login needed | Fixed in | CISA KEV |
|---|---|---|---|---|---|---|---|
| Nov 3, 2026 | CVE-2026-28336 |
Dameware | Dameware Command Injection Vulnerability | 9.9 | Low | 2026.3.1 |
No |
| Nov 3, 2026 | CVE-2026-28335 |
Dameware | Dameware Buffer Overflow Vulnerability | 8.4 | Low | 2026.3.1 |
No |
| Nov 3, 2026 | CVE-2026-28327 |
Dameware | Dameware DLL Hijacking Vulnerability | 8.2 | Low | 2026.3.1 |
No |
| Oct 20, 2026 | CVE-2026-28331 |
Patch Manager | Patch Manager Sensitive Information Exposure Vulnerability | 4.4 | High | 2026.4 |
No |
| Oct 20, 2026 | CVE-2026-28330 |
Platform (Orion) / Observability SH | Observability Self-Hosted Cross-Site Scripting Vulnerability | 4.6 | Low | 2026.4 |
No |
| Oct 20, 2026 | CVE-2026-28329 |
Platform (Orion) / Observability SH | Observability Self-Hosted Server-Side Request Forgery (SSRF) | 6.4 | Low | 2026.4 |
No |
| Oct 20, 2026 | CVE-2026-28328 |
Platform (Orion) / Observability SH | Observability Self-Hosted broken authorization schema | 8.8 | Low | 2026.4 |
No |
| Sep 22, 2026 | CVE-2026-28325 |
Platform (Orion) / Observability SH | Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability | 8.8 | None | 2026.2.3 |
No |
| Sep 22, 2026 | CVE-2026-28324 |
Platform (Orion) / Observability SH | Observability Self-Hosted Remote Code Execution Vulnerability | 9.8 | None | 2026.2.3 |
No |
| Sep 17, 2026 | CVE-2026-28326 |
Access Rights Mgr | Access Rights Manager Unauthenticated Remote Code Execution Vulnerability | 8.8 | None | 2026.2.1 |
No |
| Jul 30, 2026 | CVE-2026-28323 |
Web Help Desk | Web Help Desk SAML Authentication Bypass Vulnerability | 9.8 | None | 2026.2.1 |
No |
| Jul 21, 2026 | CVE-2026-28321 |
Serv-U | Serv-U Broken Access Control Vulnerability | 9.1 | High | 2026.3 |
No |
| Jul 21, 2026 | CVE-2026-28317 |
Serv-U | Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | High | 2026.3 |
No |
| Jul 21, 2026 | CVE-2026-28316 |
Serv-U | Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | High | 2026.3 |
No |
| Jul 21, 2026 | CVE-2026-28315 |
Serv-U | Serv-U Authenticated Stored Cross-site Scripting (XSS) Vulnerability | 6.2 | High | 2026.3 |
No |
| Jul 21, 2026 | CVE-2026-28314 |
Serv-U | Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | High | 2026.3 |
No |
| Jul 21, 2026 | CVE-2026-28313 |
Serv-U | Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | High | 2026.3 |
No |
| Jul 21, 2026 | CVE-2026-28312 |
Serv-U | Serv-U Privilege Escalation Vulnerability | 9.1 | High | 2026.3 |
No |
| Jul 21, 2026 | CVE-2026-28310 |
Serv-U | Serv-U Privilege Escalation Vulnerability | 9.1 | High | 2026.3 |
No |
| Jul 21, 2026 | CVE-2026-28309 |
Serv-U | Serv-U Broken Access Control Vulnerability | 9.1 | High | 2026.3 |
No |
| Jul 21, 2026 | CVE-2026-28308 |
Serv-U | Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | High | 2026.3 |
No |
| Jul 21, 2026 | CVE-2026-28307 |
Serv-U | Serv-U Privilege Escalation Vulnerability | 9.1 | High | 2026.3 |
No |
| Jul 21, 2026 | CVE-2026-28306 |
Serv-U | Serv-U Privilege Escalation Vulnerability | 9.1 | High | 2026.3 |
No |
| Jul 21, 2026 | CVE-2026-28305 |
Serv-U | Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | High | 2026.3 |
No |
| Jul 21, 2026 | CVE-2026-28304 |
Serv-U | Serv-U Remote Code Execution Vulnerability | 9.1 | High | 2026.3 |
No |
| Jul 21, 2026 | CVE-2026-28302 |
Serv-U | Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | High | 2026.3 |
No |
| Jun 30, 2026 | CVE-2026-28322 |
DPA and SQL Sentry | Database Performance Analyzer Stored Cross-Site Scripting Vulnerability | 5.6 | High | 2026.2 |
No |
| Jun 9, 2026 | CVE-2026-28301 |
Platform (Orion) / Observability SH | Observability Self-Hosted Open Redirect Vulnerability | 4.8 | Low | 2026.2 |
No |
| Jun 4, 2026 | CVE-2026-28318 |
Serv-U | Serv-U Unauthenticated Denial of Service Vulnerability | 7.5 | None | 15.5.4 HF1 |
Jun 5, 2026 |
| Jun 2, 2026 | CVE-2026-28299 |
Web Help Desk | Web Help Desk Denial-of-Service Vulnerability | 8.2 | None | later than 2026.1 |
No |
Serv-U moved from 15.5.x version numbers to year-based releases in 2026: the July batch is fixed in Serv-U 2026.3, per SolarWinds’ CVE records. “Login needed” is the CVSS privileges-required value in SolarWinds’ v3.1 vector.
The exploitation ledger: every SolarWinds CVE in CISA KEV
CISA lists a CVE in KEV only when it has reliable evidence of exploitation in the wild. 11 SolarWinds CVEs are on the list as of catalog version 2026.11.10, released Nov 10, 2026. Three were added on November 3, 2021, the day the catalog launched, so their long lags (up to 1,965 days for a 2016 Virtualization Manager flaw) say more about the catalog’s start date than about attacker speed.
Figure 1. Days from first public CVE record to CISA KEV listing, SolarWinds CVEs
Bars beyond 210 days are cut (break marks). “First public CVE record” is the earlier of the CVE Program publish date and the NVD publish date.
| KEV added | CVE | Product | Issue | CVSS | Login needed | First CVE record | Days to KEV | Federal deadline, days | Ransomware flag | Fixed in |
|---|---|---|---|---|---|---|---|---|---|---|
| Jun 5, 2026 | CVE-2026-28318 |
Serv-U | Serv-U Unauthenticated Denial of Service Vulnerability | 7.5 | None | Jun 4, 2026 | 1 | 14 | Unknown | 15.5.4 HF1 |
| Mar 9, 2026 | CVE-2025-26399 |
Web Help Desk | Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability | 9.8 | None | Sep 23, 2025 | 167 | 3 | Known | 12.8.7 HF1 |
| Feb 12, 2026 | CVE-2025-40536 |
Web Help Desk | Web Help Desk Security Control Bypass Vulnerability | 8.1 | None | Jan 28, 2026 | 15 | 3 | Unknown | 2026.1 |
| Feb 3, 2026 | CVE-2025-40551 |
Web Help Desk | Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability | 9.8 | None | Jan 28, 2026 | 6 | 3 | Unknown | 2026.1 |
| Oct 15, 2024 | CVE-2024-28987 |
Web Help Desk | Web Help Desk Hardcoded Credential Vulnerability | 9.1 | None | Aug 21, 2024 | 55 | 21 | Unknown | 12.8.3 HF2 |
| Aug 15, 2024 | CVE-2024-28986 |
Web Help Desk | Web Help Desk Java Deserialization Remote Code Execution Vulnerability | 9.8 | None | Aug 13, 2024 | 2 | 21 | Unknown | 12.8.3 HF1 |
| Jul 17, 2024 | CVE-2024-28995 |
Serv-U | Serv-U L Directory Traversal Vulnerability | 8.6 | None | Jun 6, 2024 | 41 | 21 | Unknown | 15.4.2 HF2 |
| Jan 21, 2022 | CVE-2021-35247 |
Serv-U | Improper Input Validation Vulnerability in Serv-U | 4.3 | None | Jan 7, 2022 | 14 | 14 | Unknown | 15.3 |
| Nov 3, 2021 | CVE-2016-3643 |
Kiwi, TFTP, other | Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by using a misconfiguration… | 7.8 | Low | Jun 17, 2016 | 1,965 | 181 | Unknown | see advisory |
| Nov 3, 2021 | CVE-2020-10148 |
Platform (Orion) / Observability SH | Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands | 9.8 | None | Dec 29, 2020 | 309 | 181 | Unknown | 2019.4 HF6 |
| Nov 3, 2021 | CVE-2021-35211 |
Serv-U | Serv-U Remote Memory Escape Vulnerability | 9.0 | None | Jul 14, 2021 | 112 | 14 | Known | 15.2.3 HF2 |
CISA’s federal patch window for SolarWinds flaws has shrunk. CVE-2024-28986 in Web Help Desk got 21 days in August 2024; CVE-2025-40551, CVE-2025-40536 and CVE-2025-26399 got 3 days each in 2026. Across all 1,779 KEV entries, 361 (20.3%) carry the Known ransomware flag; for SolarWinds it is 2 of 11. Our analysis of the CISA KEV catalog covers the other vendors.
Web Help Desk: a chain of patch bypasses
SolarWinds’ CVE text for CVE-2025-26399 (published September 23, 2025, CVSS 9.8) calls it “a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.” CVE-2024-28986 entered KEV 2 days after disclosure in August 2024; CVE-2025-26399 entered on March 9, 2026 with the Known ransomware flag. The January 28, 2026 batch added six more WHD CVEs, four at 9.8, all fixed in WHD 2026.1.
Serv-U: internet-facing file transfer
Serv-U has 87 CVEs, the second most, and 4 KEV entries. CVE-2021-35211 (CVSS 9.0) was reported by Microsoft, per SolarWinds’ CVE text, and fixed in 15.2.3 HF2; CISA flags it for ransomware use. CVE-2024-28995, a path traversal fixed in 15.4.2 HF2, reached KEV 41 days after disclosure. CVE-2026-28318, an unauthenticated crash via Content-Encoding: deflate, took 1 day.
SolarWinds vulnerabilities by product
The SolarWinds Platform, the product line once called Orion and named Observability Self-Hosted in SolarWinds’ CVE records since June 2025, has the most CVEs (109). Access Rights Manager has 13 critical CVEs and none in KEV. Network Configuration Manager has had no new CVE since November 2023.
| Product family | CVEs | CVSS 9.0+ | 9.0+ with no login | 2026, to Nov 13 | In KEV | Ransomware flag | Latest CVE | Latest fixed version named by SolarWinds |
|---|---|---|---|---|---|---|---|---|
| SolarWinds Platform (Orion) and Observability Self-Hosted | 109 | 8 | 7 | 8 | 1 | 0 | Oct 20, 2026 | 2026.4 (CVE-2026-28330, Oct 2026) |
| Serv-U | 87 | 31 | 5 | 20 | 4 | 1 | Jul 21, 2026 | 2026.3 (CVE-2026-28321, Jul 2026) |
| Access Rights Manager | 33 | 13 | 10 | 1 | 0 | 0 | Sep 17, 2026 | 2026.2.1 (CVE-2026-28326, Sep 2026) |
| Web Help Desk | 29 | 9 | 9 | 8 | 5 | 1 | Jul 30, 2026 | 2026.2.1 (CVE-2026-28323, Jul 2026) |
| Kiwi, TFTP and other tools | 27 | 8 | 5 | 1 | 1 | 0 | Apr 4, 2026 | 1.3.1 (CVE-2024-45718, Feb 2025) |
| Dameware | 14 | 5 | 3 | 3 | 0 | 0 | Nov 3, 2026 | 2026.3.1 (CVE-2026-28336, Nov 2026) |
| Database Performance Analyzer and SQL Sentry | 12 | 0 | 0 | 1 | 0 | 0 | Jun 30, 2026 | 2026.2 (CVE-2026-28322, Jun 2026) |
| Security Event Manager (LEM) | 12 | 1 | 1 | 0 | 0 | 0 | Mar 1, 2024 | 2023.4.1 (CVE-2024-0692, Mar 2024) |
| Network Configuration Manager | 9 | 0 | 0 | 0 | 0 | 0 | Nov 9, 2023 | 2023.4.1 (CVE-2023-40055, Nov 2023) |
| Patch Manager | 4 | 0 | 0 | 1 | 0 | 0 | Oct 20, 2026 | 2026.4 (CVE-2026-28331, Oct 2026) |
| SaaS (Pingdom, Service Desk) | 2 | 0 | 0 | 0 | 0 | 0 | Mar 17, 2025 | n/a |
Figure 2. SolarWinds CVEs by product family and year, 2019 to 2026
Years use the first public CVE record. 61 CVEs from 2001 to 2018 are in the totals but not the year columns; many older Serv-U records date from before SolarWinds bought the product.
Critical does not always mean exposed
75 SolarWinds CVEs score 9.0 or higher. 40 of them need no login under the vector in the CVE record. The 2026 spike is mostly Serv-U: SolarWinds’ text for the July 21 batch describes flaws such as a “domain administrator” elevating to system administrator, and notes the impact is lower on Windows. Those score 9.1 because the CVSS scope changes, but an attacker needs an admin account first.
Figure 3. Critical SolarWinds CVEs per year, by the login an attacker needs
*2026 runs to November 13. Privileges come from SolarWinds’ CVSS v3.1 vector where it filed one, else NVD’s. “No v3 vector” marks older records scored only in CVSS v2.
NVD enrichment lags. 12 of the 43 CVEs published in 2026 still show “Awaiting Analysis” in NVD, including all 3 Dameware CVEs of November 3 and CVE-2026-28324, so scanners that wait for NVD CPE data can miss them. SolarWinds’ own CVE records already carry scores and fixed versions. Our CVE statistics for 2026 track the same backlog across all vendors.
The SolarWinds attack explained: SUNBURST was not a CVE
Most searches for SolarWinds vulnerabilities still lead back to 2020. That event was different in kind. SolarWinds’ 8-K of December 14, 2020 says malicious code “was inserted within the Orion products and existed in updates released between March and June 2020,” after “a compromise of the Orion software build system.” CISA issued Emergency Directive 21-01 on December 13, 2020, ordering federal agencies to disconnect Orion 2019.4 through 2020.2.1 HF1, and on April 15, 2021 the US government attributed the campaign to Russia’s Foreign Intelligence Service (SVR). CISA’s page now marks ED 21-01 as closed.
Figure 4. Two separate stories: the 2020 compromise and ordinary product CVEs
| 2020 supply-chain compromise (SUNBURST) | Ordinary SolarWinds product CVEs | |
|---|---|---|
| What it was | Malicious code inserted into Orion builds after an attacker compromised SolarWinds’ build system (SolarWinds 8-K, Dec 14, 2020) | Coding flaws in shipped products (deserialization, path traversal, hardcoded credentials, injection) |
| CVE ID | None. Orion releases are listed by version in CISA AA20-352A | 338 CVEs in NVD for SolarWinds products, 210 filed by SolarWinds as a CNA |
| Affected versions | Orion Platform 2019.4 HF5, 2020.2 RC1, 2020.2 RC2, 2020.2 and 2020.2 HF1 (AA20-352A); CISA required at least 2020.2.1 HF2 | Per product; see the tables below |
| Scale | About 33,000 active Orion maintenance customers notified; fewer than 18,000 believed to have the tainted build (8-K) | Varies; KEV lists confirmed exploitation, not victim counts |
| Attribution | Russian Foreign Intelligence Service (SVR), per the US government on April 15, 2021 | Mostly unattributed; CISA flags 2 as used in ransomware |
| Fix | Rebuild or upgrade under CISA ED 21-01 guidance; NSA verified 2020.2.1 HF2 removed the malicious code | Upgrade to the fixed version SolarWinds names in each CVE record |
CVE-2020-10148 is often confused with SUNBURST. NVD describes it as an Orion API authentication bypass affecting 2019.4 HF5, 2020.2 and 2020.2 HF1, the same builds, published December 29, 2020. It is a coding flaw with its own CVE, filed by CERT/CC, and a fix (2019.4 HF 6 or 2020.2.1 HF 2). The same record lists “SUPERNOVA Patch” releases of December 23, 2020 for Orion 2018.2, 2018.4 and 2019.2, which ties it to the separate SUPERNOVA web shell, not to SUNBURST. It sits in KEV. The SEC sued SolarWinds and its CISO over SUNBURST disclosures on October 30, 2023 and dropped the case with prejudice on November 20, 2025; our tracker of SEC Item 1.05 cyber disclosures shows how disclosure rules changed after it.
Every SolarWinds CVE, with fixed version and KEV status
338 of 338 CVEs shown
| First record | CVE | Product | Issue | CVSS | Login needed | Fixed in | KEV added | Ransomware | NVD status |
|---|---|---|---|---|---|---|---|---|---|
| 2026-11-03 | CVE-2026-28336 | Dameware | Dameware Command Injection Vulnerability | 9.9 | Low | 2026.3.1 |
No | Awaiting Analysis | |
| 2026-11-03 | CVE-2026-28335 | Dameware | Dameware Buffer Overflow Vulnerability | 8.4 | Low | 2026.3.1 |
No | Awaiting Analysis | |
| 2026-11-03 | CVE-2026-28327 | Dameware | Dameware DLL Hijacking Vulnerability | 8.2 | Low | 2026.3.1 |
No | Awaiting Analysis | |
| 2026-10-20 | CVE-2026-28331 | Patch Manager | Patch Manager Sensitive Information Exposure Vulnerability | 4.4 | High | 2026.4 |
No | Awaiting Analysis | |
| 2026-10-20 | CVE-2026-28330 | Platform (Orion) / Observability SH | Observability Self-Hosted Cross-Site Scripting Vulnerability | 4.6 | Low | 2026.4 |
No | Awaiting Analysis | |
| 2026-10-20 | CVE-2026-28329 | Platform (Orion) / Observability SH | Observability Self-Hosted Server-Side Request Forgery (SSRF) | 6.4 | Low | 2026.4 |
No | Awaiting Analysis | |
| 2026-10-20 | CVE-2026-28328 | Platform (Orion) / Observability SH | Observability Self-Hosted broken authorization schema | 8.8 | Low | 2026.4 |
No | Awaiting Analysis | |
| 2026-09-22 | CVE-2026-28325 | Platform (Orion) / Observability SH | Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability | 8.8 | None | 2026.2.3 |
No | Awaiting Analysis | |
| 2026-09-22 | CVE-2026-28324 | Platform (Orion) / Observability SH | Observability Self-Hosted Remote Code Execution Vulnerability | 9.8 | None | 2026.2.3 |
No | Awaiting Analysis | |
| 2026-09-17 | CVE-2026-28326 | Access Rights Mgr | Access Rights Manager Unauthenticated Remote Code Execution Vulnerability | 8.8 | None | 2026.2.1 |
No | Awaiting Analysis | |
| 2026-07-30 | CVE-2026-28323 | Web Help Desk | Web Help Desk SAML Authentication Bypass Vulnerability | 9.8 | None | 2026.2.1 |
No | Analyzed | |
| 2026-07-21 | CVE-2026-28321 | Serv-U | Serv-U Broken Access Control Vulnerability | 9.1 | High | 2026.3 |
No | Analyzed | |
| 2026-07-21 | CVE-2026-28317 | Serv-U | Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | High | 2026.3 |
No | Analyzed | |
| 2026-07-21 | CVE-2026-28316 | Serv-U | Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | High | 2026.3 |
No | Analyzed | |
| 2026-07-21 | CVE-2026-28315 | Serv-U | Serv-U Authenticated Stored Cross-site Scripting (XSS) Vulnerability | 6.2 | High | 2026.3 |
No | Analyzed | |
| 2026-07-21 | CVE-2026-28314 | Serv-U | Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | High | 2026.3 |
No | Analyzed | |
| 2026-07-21 | CVE-2026-28313 | Serv-U | Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | High | 2026.3 |
No | Analyzed | |
| 2026-07-21 | CVE-2026-28312 | Serv-U | Serv-U Privilege Escalation Vulnerability | 9.1 | High | 2026.3 |
No | Analyzed | |
| 2026-07-21 | CVE-2026-28310 | Serv-U | Serv-U Privilege Escalation Vulnerability | 9.1 | High | 2026.3 |
No | Analyzed | |
| 2026-07-21 | CVE-2026-28309 | Serv-U | Serv-U Broken Access Control Vulnerability | 9.1 | High | 2026.3 |
No | Analyzed | |
| 2026-07-21 | CVE-2026-28308 | Serv-U | Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | High | 2026.3 |
No | Analyzed | |
| 2026-07-21 | CVE-2026-28307 | Serv-U | Serv-U Privilege Escalation Vulnerability | 9.1 | High | 2026.3 |
No | Analyzed | |
| 2026-07-21 | CVE-2026-28306 | Serv-U | Serv-U Privilege Escalation Vulnerability | 9.1 | High | 2026.3 |
No | Analyzed | |
| 2026-07-21 | CVE-2026-28305 | Serv-U | Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | High | 2026.3 |
No | Analyzed | |
| 2026-07-21 | CVE-2026-28304 | Serv-U | Serv-U Remote Code Execution Vulnerability | 9.1 | High | 2026.3 |
No | Analyzed | |
| 2026-07-21 | CVE-2026-28302 | Serv-U | Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | High | 2026.3 |
No | Analyzed | |
| 2026-06-30 | CVE-2026-28322 | DPA and SQL Sentry | Database Performance Analyzer Stored Cross-Site Scripting Vulnerability | 5.6 | High | 2026.2 |
No | Awaiting Analysis | |
| 2026-06-09 | CVE-2026-28301 | Platform (Orion) / Observability SH | Observability Self-Hosted Open Redirect Vulnerability | 4.8 | Low | 2026.2 |
No | Awaiting Analysis | |
| 2026-06-04 | CVE-2026-28318 | Serv-U | Serv-U Unauthenticated Denial of Service Vulnerability | 7.5 | None | 15.5.4 HF1 |
2026-06-05 | Unknown | Analyzed |
| 2026-06-02 | CVE-2026-28299 | Web Help Desk | Web Help Desk Denial-of-Service Vulnerability | 8.2 | None | later than 2026.1 |
No | Analyzed | |
| 2026-04-04 | CVE-2018-25252 | Kiwi, TFTP, other | FTP Voyager 16.2.0 Denial of Service via Malformed Site Profile | 5.5 | None | later than 16.2.0 |
No | Analyzed | |
| 2026-03-26 | CVE-2026-28298 | Platform (Orion) / Observability SH | Observability Self-Hosted Stored Cross-Site Scripting Vulnerability | 5.9 | High | later than 2026.1.1 |
No | Analyzed | |
| 2026-03-26 | CVE-2026-28297 | Platform (Orion) / Observability SH | Observability Self-Hosted Stored Cross-Site Scripting Vulnerability | 6.1 | High | later than 2026.1.1 |
No | Analyzed | |
| 2026-02-24 | CVE-2025-40541 | Serv-U | Serv-U Insecure Direct Object Reference (IDOR) Remote Code Execution Vulnerability | 9.1 | High | 15.5.4 |
No | Analyzed | |
| 2026-02-24 | CVE-2025-40540 | Serv-U | Serv-U Type Confusion Remote Code Execution Vulnerability | 9.1 | High | 15.5.4 |
No | Analyzed | |
| 2026-02-24 | CVE-2025-40539 | Serv-U | Serv-U Type Confusion Remote Code Execution Vulnerability | 9.1 | High | 15.5.4 |
No | Analyzed | |
| 2026-02-24 | CVE-2025-40538 | Serv-U | Serv-U Broken Access Control Remote Code Execution Vulnerability | 9.1 | High | 15.5.4 |
No | Analyzed | |
| 2026-01-28 | CVE-2025-40554 | Web Help Desk | Web Help Desk Authentication Bypass Vulnerability | 9.8 | None | 2026.1 |
No | Analyzed | |
| 2026-01-28 | CVE-2025-40553 | Web Help Desk | Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability | 9.8 | None | 2026.1 |
No | Modified | |
| 2026-01-28 | CVE-2025-40552 | Web Help Desk | Web Help Desk Authentication Bypass Vulnerability | 9.8 | None | 2026.1 |
No | Modified | |
| 2026-01-28 | CVE-2025-40551 | Web Help Desk | Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability | 9.8 | None | 2026.1 |
2026-02-03 | Unknown | Analyzed |
| 2026-01-28 | CVE-2025-40537 | Web Help Desk | Web Help Desk Hardcoded Credentials Vulnerability | 7.5 | Low | 2026.1 |
No | Analyzed | |
| 2026-01-28 | CVE-2025-40536 | Web Help Desk | Web Help Desk Security Control Bypass Vulnerability | 8.1 | None | 2026.1 |
2026-02-12 | Unknown | Analyzed |
| 2025-11-18 | CVE-2025-40549 | Serv-U | Serv-U Path Restriction Bypass Vulnerability | 9.1 | High | 15.5.3 |
No | Analyzed | |
| 2025-11-18 | CVE-2025-40548 | Serv-U | Serv-U Broken Access Control – Remote Code Execution Vulnerability | 9.1 | High | 15.5.3 |
No | Analyzed | |
| 2025-11-18 | CVE-2025-40547 | Serv-U | Serv-U Logic Abuse – Remote Code Execution Vulnerability | 9.1 | High | 15.5.3 |
No | Analyzed | |
| 2025-11-18 | CVE-2025-40545 | Platform (Orion) / Observability SH | Observability Self-Hosted Open Redirection Vulnerability | 4.8 | Low | 2025.4 |
No | Analyzed | |
| 2025-11-18 | CVE-2025-26391 | Platform (Orion) / Observability SH | Observability Self-Hosted XSS Vulnerability | 5.4 | Low | 2025.4 |
No | Analyzed | |
| 2025-10-21 | CVE-2025-26392 | Platform (Orion) / Observability SH | Observability Self-Hosted SQL Injection Vulnerability | 5.4 | Low | 2025.4 |
No | Analyzed | |
| 2025-09-23 | CVE-2025-26399 | Web Help Desk | Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability | 9.8 | None | 12.8.7 HF1 |
2026-03-09 | Known | Analyzed |
| 2025-09-01 | CVE-2024-28988 | Web Help Desk | Web Help Desk Java Deserialization Remote Code Execution Vulnerability | 9.8 | None | 12.8.3 HF3 |
No | Analyzed | |
| 2025-08-12 | CVE-2025-26398 | DPA and SQL Sentry | Database Performance Analyzer Hard-coded Cryptographic Key Vulnerability | 5.6 | High | 2025.3 |
No | Analyzed | |
| 2025-07-29 | CVE-2025-26400 | Web Help Desk | Web Help Desk XML External Entity Injection (XXE) Vulnerability | 5.3 | Low | 12.8.7 |
No | Analyzed | |
| 2025-07-24 | CVE-2025-26397 | Platform (Orion) / Observability SH | Observability Self-Hosted Deserialization of Untrusted Data Local Privilege Escalation Vulnerability | 7.8 | Low | 2025.2.1 |
No | Analyzed | |
| 2025-06-10 | CVE-2025-26395 | Platform (Orion) / Observability SH | SWOSH DOM-based reflective XSS Vulnerability | 7.1 | High | 2025.2 |
No | Analyzed | |
| 2025-06-10 | CVE-2025-26394 | Platform (Orion) / Observability SH | SWOSH Open Redirection Vulnerability | 4.8 | Low | 2025.2 |
No | Analyzed | |
| 2025-06-02 | CVE-2025-26396 | Dameware | Dameware Mini Remote Control Service Incorrect Permissions Local Privilege Escalation Vulnerability | 7.8 | Low | 12.3.2 |
No | Deferred | |
| 2025-04-15 | CVE-2024-45712 | Serv-U | Serv-U Client-Side Cross-Site Scripting Vulnerability | 2.6 | Low | 15.5.1 |
No | Analyzed | |
| 2025-03-17 | CVE-2025-26393 | SaaS | Service Desk Broken Access Control Vulnerability | 5.4 | Low | n/a |
No | Deferred | |
| 2025-02-11 | CVE-2024-52612 | Platform (Orion) / Observability SH | Platform Reflected Cross-Site Scripting Vulnerability | 6.8 | High | 2025.1 |
No | Analyzed | |
| 2025-02-11 | CVE-2024-52611 | Platform (Orion) / Observability SH | Platform Information Disclosure Vulnerability | 3.5 | Low | 2025.1 |
No | Analyzed | |
| 2025-02-11 | CVE-2024-52606 | Platform (Orion) / Observability SH | Platform Server-Side Request Forgery Vulnerability | 3.5 | Low | 2025.1 |
No | Analyzed | |
| 2025-02-11 | CVE-2024-45718 | Kiwi, TFTP, other | Sensitive data disclosure vulnerability | 4.6 | High | 1.3.1 |
No | Deferred | |
| 2025-02-11 | CVE-2024-28989 | Web Help Desk | Web Help Desk Cryptographic Key Management Vulnerability | 5.5 | Low | 12.8.5 |
No | Analyzed | |
| 2024-12-10 | CVE-2024-45709 | Web Help Desk | Web Help Desk Local File Read Vulnerability | 5.3 | None | 12.8.4 |
No | Analyzed | |
| 2024-12-04 | CVE-2024-45717 | Platform (Orion) / Observability SH | Platform Cross- Site Scripting Vulnerability | 7.0 | Low | 2024.4.1 |
No | Analyzed | |
| 2024-10-17 | CVE-2024-45713 | Kiwi, TFTP, other | Kiwi CatTools Sensitive Information Disclosure Vulnerability | 5.1 | High | 3.12.4 |
No | Analyzed | |
| 2024-10-16 | CVE-2024-45715 | Platform (Orion) / Observability SH | Platform Edit Function Cross-Site Scripting Vulnerability | 7.1 | High | 2024.4 |
No | Analyzed | |
| 2024-10-16 | CVE-2024-45714 | Serv-U | Serv-U Stored XSS Vulnerability | 4.8 | Low | 15.5 |
No | Analyzed | |
| 2024-10-16 | CVE-2024-45711 | Serv-U | Serv-U FTP Service Directory Traversal Remote Code Execution Vulnerability | 7.5 | Low | 15.5 |
No | Analyzed | |
| 2024-10-16 | CVE-2024-45710 | Platform (Orion) / Observability SH | Platform Uncontrolled Search Path Element Local Privilege Escalation Vulnerability | 7.8 | Low | 2024.4 |
No | Analyzed | |
| 2024-09-12 | CVE-2024-28991 | Access Rights Mgr | Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution | 9.0 | Low | 2024.3.1 |
No | Analyzed | |
| 2024-09-12 | CVE-2024-28990 | Access Rights Mgr | Access Rights Manager (ARM) Hardcoded Credentials Authentication Bypass Vulnerability | 6.3 | None | 2024.3.1 |
No | Analyzed | |
| 2024-08-21 | CVE-2024-28987 | Web Help Desk | Web Help Desk Hardcoded Credential Vulnerability | 9.1 | None | 12.8.3 HF2 |
2024-10-15 | Unknown | Analyzed |
| 2024-08-13 | CVE-2024-28986 | Web Help Desk | Web Help Desk Java Deserialization Remote Code Execution Vulnerability | 9.8 | None | 12.8.3 HF1 |
2024-08-15 | Unknown | Analyzed |
| 2024-07-17 | CVE-2024-28993 | Access Rights Mgr | Access Rights Manager Directory Traversal and Information Disclosure Vulnerability | 7.6 | None | 2024.3 |
No | Analyzed | |
| 2024-07-17 | CVE-2024-28992 | Access Rights Mgr | Access Rights Manager Directory Traversal and Information Disclosure Vulnerability | 7.6 | None | 2024.3 |
No | Analyzed | |
| 2024-07-17 | CVE-2024-28074 | Access Rights Mgr | Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability | 9.6 | None | 2024.3 |
No | Analyzed | |
| 2024-07-17 | CVE-2024-23475 | Access Rights Mgr | Access Rights Manager Directory Traversal and Information Disclosure Vulnerability | 9.6 | None | 2024.3 |
No | Analyzed | |
| 2024-07-17 | CVE-2024-23474 | Access Rights Mgr | Access Rights Manager (ARM) deleteTransferFile Directory Traversal Arbitrary File Deletion and Information… | 7.6 | None | 2024.3 |
No | Analyzed | |
| 2024-07-17 | CVE-2024-23472 | Access Rights Mgr | Access Rights Manager Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability | 9.6 | None | 2024.3 |
No | Analyzed | |
| 2024-07-17 | CVE-2024-23471 | Access Rights Mgr | Access Rights Manager (ARM) CreateFile Directory Traversal Remote Code Execution Vulnerability | 9.6 | None | 2024.3 |
No | Analyzed | |
| 2024-07-17 | CVE-2024-23470 | Access Rights Mgr | Access Rights Manager (ARM) UserScriptHumster Exposed Dangerous Method Remote Command Execution Vulnerability | 9.6 | None | 2024.3 |
No | Analyzed | |
| 2024-07-17 | CVE-2024-23469 | Access Rights Mgr | Access Rights Manager Exposed Dangerous Method Remote Code Execution Vulnerability | 9.6 | None | 2024.3 |
No | Analyzed | |
| 2024-07-17 | CVE-2024-23468 | Access Rights Mgr | Access Rights Manager Directory Traversal and Information Disclosure Vulnerability | 7.6 | None | 2024.3 |
No | Analyzed | |
| 2024-07-17 | CVE-2024-23467 | Access Rights Mgr | Access Rights Manager Directory Traversal Remote Code Execution Vulnerability | 9.6 | None | 2024.3 |
No | Analyzed | |
| 2024-07-17 | CVE-2024-23466 | Access Rights Mgr | Access Rights Manager Directory Traversal Remote Code Execution Vulnerability | 9.6 | None | 2024.3 |
No | Analyzed | |
| 2024-07-17 | CVE-2024-23465 | Access Rights Mgr | Access Rights Manager (ARM) ChangeHumster Exposed Dangerous Method Authentication Bypass Vulnerability | 8.3 | None | 2024.3 |
No | Analyzed | |
| 2024-06-06 | CVE-2024-28995 | Serv-U | Serv-U L Directory Traversal Vulnerability | 8.6 | None | 15.4.2 HF2 |
2024-07-17 | Unknown | Analyzed |
| 2024-06-04 | CVE-2024-29004 | Platform (Orion) / Observability SH | Platform Stored XSS Vulnerability | 7.1 | High | 2024.2 |
No | Analyzed | |
| 2024-06-04 | CVE-2024-28999 | Platform (Orion) / Observability SH | Platform Race Condition Vulnerability | 6.4 | None | 2024.2 |
No | Analyzed | |
| 2024-06-04 | CVE-2024-28996 | Platform (Orion) / Observability SH | Platform SWQL Injection Vulnerability | 7.5 | None | 2024.2 |
No | Analyzed | |
| 2024-05-20 | CVE-2024-29000 | Platform (Orion) / Observability SH | Platform Reflected XSS Vulnerability | 7.9 | High | 2024.1.1 |
No | Analyzed | |
| 2024-05-09 | CVE-2024-28075 | Access Rights Mgr | ARM Deserialization of Untrusted Data Remote Code Execution | 9.0 | Low | 2023.2.4 |
No | Analyzed | |
| 2024-05-09 | CVE-2024-23473 | Access Rights Mgr | Access Rights Manager (ARM) Hard-Coded Credentials Authentication Bypass Vulnerability | 8.6 | None | 2023.2.4 |
No | Analyzed | |
| 2024-05-03 | CVE-2024-28072 | Serv-U | Arbitrary File Overwrite Vulnerability | 5.7 | High | 15.4.2 HF1 |
No | Analyzed | |
| 2024-04-18 | CVE-2024-29003 | Platform (Orion) / Observability SH | Platform Cross Site Scripting Vulnerability | 7.5 | Low | 2024.1.1 |
No | Analyzed | |
| 2024-04-18 | CVE-2024-29001 | Platform (Orion) / Observability SH | Platform SWQL Injection Vulnerability | 7.5 | Low | 2024.1.1 |
No | Analyzed | |
| 2024-04-18 | CVE-2024-28076 | Platform (Orion) / Observability SH | Platform Arbitrary Open Redirection Vulnerability | 7.0 | None | 2024.1.1 |
No | Analyzed | |
| 2024-04-17 | CVE-2024-28073 | Serv-U | Serv-U Directory Traversal Remote Code Execution Vulnerability | 8.4 | High | later than 15.4.1 |
No | Analyzed | |
| 2024-03-01 | CVE-2024-0692 | Security Event Manager | Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability | 8.8 | None | 2023.4.1 |
No | Analyzed | |
| 2024-02-15 | CVE-2024-23479 | Access Rights Mgr | Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability | 9.6 | None | 2023.2.3 |
No | Modified | |
| 2024-02-15 | CVE-2024-23478 | Access Rights Mgr | Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution | 8.0 | Low | 2023.2.3 |
No | Modified | |
| 2024-02-15 | CVE-2024-23477 | Access Rights Mgr | Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability | 7.9 | None | 2023.2.3 |
No | Modified | |
| 2024-02-15 | CVE-2024-23476 | Access Rights Mgr | Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability | 9.6 | None | 2023.2.3 |
No | Modified | |
| 2024-02-15 | CVE-2023-40057 | Access Rights Mgr | Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution | 9.0 | Low | 2023.2.3 |
No | Modified | |
| 2024-02-06 | CVE-2023-50395 | Platform (Orion) / Observability SH | SQL Injection Remote Code Execution Vulnerability | 8.0 | Low | 2024.1 |
No | Analyzed | |
| 2024-02-06 | CVE-2023-35188 | Platform (Orion) / Observability SH | SQL Injection Remote Code Execution Vulnerability | 8.0 | Low | 2024.1 |
No | Analyzed | |
| 2023-12-21 | CVE-2023-40058 | Access Rights Mgr | Sensitive Information Disclosure Vulnerability | 6.5 | None | 2023.2.2 |
No | Modified | |
| 2023-12-06 | CVE-2023-40053 | Serv-U | HTML injection Vulnerability in Serv-U 15.4 | 5.0 | Low | 15.4.1 |
No | Modified | |
| 2023-11-28 | CVE-2023-40056 | Platform (Orion) / Observability SH | Platform SQL Injection Remote Code Execution Vulnerability | 8.0 | Low | 2023.4.2 |
No | Modified | |
| 2023-11-09 | CVE-2023-40055 | NCM | Network Configuration Manager Directory Traversal Remote Code Execution Vulnerability | 8.0 | Low | 2023.4.1 |
No | Modified | |
| 2023-11-09 | CVE-2023-40054 | NCM | Network Configuration Manager Directory Traversal Remote Code Execution Vulnerability | 8.0 | Low | 2023.4.1 |
No | Modified | |
| 2023-11-01 | CVE-2023-40062 | Platform (Orion) / Observability SH | Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability | 8.0 | Low | 2023.4 |
No | Modified | |
| 2023-11-01 | CVE-2023-40061 | Platform (Orion) / Observability SH | Insecure Job Execution Mechanism Vulnerability | 8.8 | None | 2023.4 |
No | Analyzed | |
| 2023-11-01 | CVE-2023-33228 | NCM | Network Configuration Manager Sensitive Information Disclosure Vulnerability | 4.5 | High | 2023.4 |
No | Modified | |
| 2023-11-01 | CVE-2023-33227 | NCM | Directory Traversal Remote Code Execution Vulnerability | 8.0 | Low | 2023.4 |
No | Modified | |
| 2023-11-01 | CVE-2023-33226 | NCM | Directory Traversal Remote Code Execution Vulnerability | 8.0 | Low | 2023.4 |
No | Modified | |
| 2023-10-19 | CVE-2023-35187 | Access Rights Mgr | Access Rights Manager Directory Traversal Remote Code Execution Vulnerability | 8.8 | None | 2023.2.1 |
No | Modified | |
| 2023-10-19 | CVE-2023-35186 | Access Rights Mgr | Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability | 8.0 | Low | 2023.2.1 |
No | Modified | |
| 2023-10-19 | CVE-2023-35185 | Access Rights Mgr | Access Rights Manager OpenFile Directory Traversal Remote Code Execution Vulnerability | 6.8 | High | 2023.2.1 |
No | Analyzed | |
| 2023-10-19 | CVE-2023-35184 | Access Rights Mgr | Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability | 8.8 | None | 2023.2.1 |
No | Modified | |
| 2023-10-19 | CVE-2023-35183 | Access Rights Mgr | Access Rights Manager Incorrect Default Permissions Local Privilege Escalation Vulnerability | 7.8 | Low | 2023.2.1 |
No | Modified | |
| 2023-10-19 | CVE-2023-35182 | Access Rights Mgr | Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability | 8.8 | None | 2023.2.1 |
No | Modified | |
| 2023-10-19 | CVE-2023-35181 | Access Rights Mgr | Access Rights Manager Incorrect Default Permissions Local Privilege Escalation Vulnerability | 7.8 | Low | 2023.2.1 |
No | Modified | |
| 2023-10-19 | CVE-2023-35180 | Access Rights Mgr | Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability | 8.0 | Low | 2023.2.1 |
No | Modified | |
| 2023-09-13 | CVE-2023-23845 | Platform (Orion) / Observability SH | Platform Exposed Dangerous Method Vulnerability | 6.8 | High | 2023.3.1 |
No | Modified | |
| 2023-09-13 | CVE-2023-23840 | Platform (Orion) / Observability SH | Platform Exposed Dangerous Method Vulnerability | 6.8 | High | 2023.3.1 |
No | Modified | |
| 2023-09-07 | CVE-2023-40060 | Serv-U | 2FA/MFA Bypass Vulnerability in Serv-U 15.4 and 15.4 Hotfix 1 | 7.2 | High | 15.4 HF2 |
No | Modified | |
| 2023-08-10 | CVE-2023-35179 | Serv-U | 2FA/MFA Bypass Vulnerability in Serv-U 15.4 | 7.2 | High | 15.4 HF1 |
No | Modified | |
| 2023-07-26 | CVE-2023-3622 | Platform (Orion) / Observability SH | Access Control Bypass Vulnerability in the SolarWinds Platform | 4.3 | Low | 2023.3 |
No | Modified | |
| 2023-07-26 | CVE-2023-33229 | Platform (Orion) / Observability SH | Platform Incorrect Input Neutralization Vulnerability | 3.5 | Low | 2023.3 |
No | Modified | |
| 2023-07-26 | CVE-2023-33225 | Platform (Orion) / Observability SH | Platform Deserialization of Untrusted Data Vulnerability | 7.2 | High | 2023.3 |
No | Modified | |
| 2023-07-26 | CVE-2023-33224 | Platform (Orion) / Observability SH | Platform Incorrect Behavior Order Vulnerability | 7.2 | High | 2023.3 |
No | Modified | |
| 2023-07-26 | CVE-2023-23844 | Platform (Orion) / Observability SH | Platform Incomplete List of Disallowed Inputs Vulnerability | 7.2 | High | 2023.3 |
No | Modified | |
| 2023-07-26 | CVE-2023-23843 | Platform (Orion) / Observability SH | Platform Incorrect Comparison Vulnerability | 7.2 | High | 2023.3 |
No | Modified | |
| 2023-07-26 | CVE-2023-23842 | NCM | Network Configuration Manager Directory Traversal Vulnerability | 7.2 | High | 2023.3 |
No | Modified | |
| 2023-07-18 | CVE-2023-33231 | DPA and SQL Sentry | XSS in SolarWinds Database Performance Analyzer 2023.2 | 6.1 | None | 2023.2.100 |
No | Modified | |
| 2023-06-15 | CVE-2023-23841 | Serv-U | Serv-U Exposure of Sensitive Information Vulnerability | 7.5 | None | 15.4 |
No | Modified | |
| 2023-04-25 | CVE-2023-23839 | Platform (Orion) / Observability SH | Platform Exposure of Sensitive Information Vulnerability | 6.5 | Low | 2023.2 |
No | Modified | |
| 2023-04-25 | CVE-2023-23838 | DPA and SQL Sentry | Directory traversal and file enumeration vulnerability: Database Performance Analyzer (DPA) 2023.1 | 6.5 | Low | later than 2022.3 |
No | Modified | |
| 2023-04-25 | CVE-2023-23837 | DPA and SQL Sentry | No Exception Handling Vulnerability: Database Performance Analyzer (DPA) 2023.1 | 7.5 | None | later than 2022.3 |
No | Modified | |
| 2023-04-21 | CVE-2022-47509 | Platform (Orion) / Observability SH | Platform Incorrect Input Neutralization Vulnerability | 6.1 | None | 2023.2 |
No | Modified | |
| 2023-04-21 | CVE-2022-47505 | Platform (Orion) / Observability SH | Platform Local Privilege Escalation Vulnerability | 7.8 | Low | 2023.2 |
No | Modified | |
| 2023-04-21 | CVE-2022-36963 | Platform (Orion) / Observability SH | Platform Deserialization of Untrusted Data Vulnerability | 7.2 | High | 2023.2 |
No | Modified | |
| 2023-02-15 | CVE-2023-23836 | Platform (Orion) / Observability SH | Platform Deserialization of Untrusted Data Vulnerability | 7.2 | High | 2023.1 |
No | Modified | |
| 2023-02-15 | CVE-2022-47508 | Platform (Orion) / Observability SH | Disable NTLM: SAM 2022.4 | 7.5 | None | 2023.1 |
No | Modified | |
| 2023-02-15 | CVE-2022-47507 | Platform (Orion) / Observability SH | Platform Deserialization of Untrusted Data Vulnerability | 7.2 | High | 2023.1 |
No | Modified | |
| 2023-02-15 | CVE-2022-47506 | Platform (Orion) / Observability SH | Platform Directory Traversal Vulnerability | 7.8 | Low | 2023.1 |
No | Modified | |
| 2023-02-15 | CVE-2022-47504 | Platform (Orion) / Observability SH | Platform Deserialization of Untrusted Data Vulnerability | 7.2 | High | 2023.1 |
No | Modified | |
| 2023-02-15 | CVE-2022-47503 | Platform (Orion) / Observability SH | Platform Deserialization of Untrusted Data Vulnerability | 7.2 | High | 2023.1 |
No | Modified | |
| 2023-02-15 | CVE-2022-38111 | Platform (Orion) / Observability SH | Platform Deserialization of Untrusted Data Vulnerability | 7.2 | High | 2023.1 |
No | Modified | |
| 2023-01-20 | CVE-2022-38112 | DPA and SQL Sentry | Sensitive Information Disclosure Vulnerability | 7.5 | None | 2023.1 |
No | Modified | |
| 2023-01-20 | CVE-2022-38110 | DPA and SQL Sentry | Reflected Cross-Site Scripting Vulnerability | 5.4 | Low | 2023.1 |
No | Modified | |
| 2022-12-19 | CVE-2022-47512 | Platform (Orion) / Observability SH | Sensitive Data Disclosure Vulnerability | 5.5 | Low | 2022.4.1 |
No | Modified | |
| 2022-12-16 | CVE-2022-38106 | Serv-U | Cross-Site Scripting Vulnerability in Serv-U Web Client | 5.4 | Low | 15.3.2 |
No | Modified | |
| 2022-12-16 | CVE-2021-35252 | Serv-U | Common Key Vulnerability in Serv-U FTP Server | 7.5 | None | 15.3.2 |
No | Modified | |
| 2022-11-29 | CVE-2022-36964 | Platform (Orion) / Observability SH | Platform Deserialization of Untrusted Data | 8.8 | Low | 2022.4 |
No | Modified | |
| 2022-11-29 | CVE-2022-36962 | Platform (Orion) / Observability SH | Platform Command Injection | 7.2 | High | 2022.4 |
No | Modified | |
| 2022-11-29 | CVE-2022-36960 | Platform (Orion) / Observability SH | Platform Improper Input Validation | 8.8 | Low | 2022.4 |
No | Modified | |
| 2022-11-23 | CVE-2022-38115 | Security Event Manager | Insecure Methods Vulnerability | 5.3 | None | 2022.4 |
No | Modified | |
| 2022-11-23 | CVE-2022-38114 | Security Event Manager | Client-Side Desync Vulnerability | 6.1 | None | 2022.4 |
No | Modified | |
| 2022-11-23 | CVE-2022-38113 | Security Event Manager | Information Disclosure Vulnerability | 5.3 | None | 2022.4 |
No | Modified | |
| 2022-11-23 | CVE-2021-35246 | Kiwi, TFTP, other | Unprotected Transport of Credentials (HSTS) Vulnerability | 5.3 | None | later than 2022.3 |
No | Modified | |
| 2022-10-20 | CVE-2022-38108 | Platform (Orion) / Observability SH | Platform Deserialization of Untrusted Data | 7.2 | High | 2022.4 |
No | Modified | |
| 2022-10-20 | CVE-2022-36966 | Platform (Orion) / Observability SH | Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6 | 5.4 | Low | 2022.3 |
No | Modified | |
| 2022-10-20 | CVE-2022-36958 | Platform (Orion) / Observability SH | Platform Deserialization of Untrusted Data | 8.8 | Low | 2022.4 |
No | Modified | |
| 2022-10-20 | CVE-2022-36957 | Platform (Orion) / Observability SH | Platform Deserialization of Untrusted Data | 7.2 | High | 2022.4 |
No | Modified | |
| 2022-10-19 | CVE-2022-38107 | DPA and SQL Sentry | Sensitive Data Disclosure Vulnerability | 5.3 | None | 2022.4 |
No | Modified | |
| 2022-10-10 | CVE-2021-35226 | NCM | Hashed Credential Exposure Vulnerability | 6.5 | Low | 2020.2.5 |
No | Modified | |
| 2022-09-30 | CVE-2022-36965 | Platform (Orion) / Observability SH | Stored and DOM XSS in QoE Applications: Orion Platform | 6.1 | None | 2022.3.0 |
No | Modified | |
| 2022-09-30 | CVE-2022-36961 | Platform (Orion) / Observability SH | Orion Platform SQL Injection Privilege Escalation Vulnerability | 8.8 | Low | 2022.2.3 |
No | Modified | |
| 2022-05-17 | CVE-2021-35249 | Serv-U | Domain Admin Broken Access Control | 4.3 | Low | 15.3.1 |
No | Modified | |
| 2022-04-25 | CVE-2021-35250 | Serv-U | Directory Traversal Vulnerability in Serv-U 15.3 | 7.5 | None | 15.3 HF1 |
No | Modified | |
| 2022-04-21 | CVE-2021-35229 | DPA and SQL Sentry | Cross-Site Scripting Vulnerability using SQL Query | 6.8 | None | 2022.1 |
No | Modified | |
| 2022-03-25 | CVE-2021-35254 | Web Help Desk | Authenticated Remote Code Execution in WebHelpDesk 12.7.8 | 8.2 | Low | 12.7.8 HF1 |
No | Modified | |
| 2022-03-09 | CVE-2021-35251 | Web Help Desk | Sensitive Data Disclosure Vulnerability | 5.3 | None | 12.7.8 |
No | Modified | |
| 2022-01-07 | CVE-2021-35247 | Serv-U | Improper Input Validation Vulnerability in Serv-U | 4.3 | None | 15.3 |
2022-01-21 | Unknown | Analyzed |
| 2021-12-27 | CVE-2021-35232 | Web Help Desk | Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries | 6.8 | None | 12.7.7 HF1 |
No | Modified | |
| 2021-12-23 | CVE-2021-35243 | Web Help Desk | HTTP PUT & DELETE Methods Enabled | 5.3 | None | 12.7.7 HF1 |
No | Modified | |
| 2021-12-20 | CVE-2021-35248 | Platform (Orion) / Observability SH | Unrestricted access to Orion.UserSettings SWIS entity for low-privilege users | 6.8 | Low | 2020.2.6 HF3 |
No | Modified | |
| 2021-12-20 | CVE-2021-35244 | Platform (Orion) / Observability SH | Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6 | 6.8 | High | 2020.2.6 HF 3 |
No | Modified | |
| 2021-12-20 | CVE-2021-35234 | Platform (Orion) / Observability SH | Exposed Dangerous Functions – Privileged Escalation | 8.0 | Low | 2020.2.6 HF3 |
No | Modified | |
| 2021-12-06 | CVE-2021-35245 | Serv-U | Broken Access Control Vulnerability for SolarWinds Serv-U | 8.4 | High | 15.2.5 |
No | Modified | |
| 2021-12-06 | CVE-2021-35242 | Serv-U | A valid CSRF token is present in response to an invalid request | 8.3 | None | 15.2.5 |
No | Modified | |
| 2021-10-29 | CVE-2021-35237 | Kiwi, TFTP, other | Clickjacking Vulnerability | 5.0 | None | 9.8 |
No | Modified | |
| 2021-10-27 | CVE-2021-35236 | Kiwi, TFTP, other | Missing Secure Flag From SSL Cookie | 3.1 | None | 9.8 |
No | Modified | |
| 2021-10-27 | CVE-2021-35235 | Kiwi, TFTP, other | ASP.NET Debug Feature Enabled | 5.3 | None | 9.8 |
No | Modified | |
| 2021-10-27 | CVE-2021-35233 | Kiwi, TFTP, other | HTTP TRACK & TRACE Methods Enabled | 5.3 | None | 9.8 |
No | Modified | |
| 2021-10-25 | CVE-2021-35231 | Kiwi, TFTP, other | Unquoted Path (SMB Login) Vulnerability | 6.7 | High | 9.8 |
No | Modified | |
| 2021-10-22 | CVE-2021-35230 | Kiwi, TFTP, other | Unquoted Path Vulnerability (SMB Login) in Kiwi CatTools | 6.7 | High | 3.11.9 |
No | Modified | |
| 2021-10-21 | CVE-2021-35228 | DPA and SQL Sentry | Reflected cross site scripting affecting SolarWinds: DPA 2021.3.7388 | 5.5 | Low | 2021.3.7388 |
No | Modified | |
| 2021-10-21 | CVE-2021-35227 | Access Rights Mgr | Insecure Web Configuration for RabbitMQ Management Plugin in SolarWinds ARM | 4.7 | Low | 2021.4 |
No | Modified | |
| 2021-10-21 | CVE-2021-35225 | Platform (Orion) / Observability SH | Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5 | 5.0 | Low | 2020.2.6 HF2 |
No | Modified | |
| 2021-10-12 | CVE-2021-35214 | SaaS | Session Management Vulnerability | 4.8 | None | 13.09.2021 |
No | Modified | |
| 2021-09-08 | CVE-2021-35217 | Patch Manager | Insecure Deserialization of untrusted data causing Remote code execution vulnerability. | 8.9 | Low | 2020.2.6 |
No | Modified | |
| 2021-09-01 | CVE-2021-35238 | Platform (Orion) / Observability SH | Stored XSS through URL POST parameter in CreateExternalWebsite Vulnerability | 4.8 | High | 2020.2.6 HF1 |
No | Modified | |
| 2021-09-01 | CVE-2021-35218 | Platform (Orion) / Observability SH | Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability | 8.9 | Low | 2020.2.6 |
No | Modified | |
| 2021-09-01 | CVE-2021-35216 | Patch Manager | Deserialization of Untrusted Data in Resource Controls Remote Code Execution | 8.9 | Low | 2020.2.6 |
No | Modified | |
| 2021-09-01 | CVE-2021-35215 | Platform (Orion) / Observability SH | ActionPluginBaseView Deserialization of Untrusted Data RCE | 8.9 | Low | 2020.2.6 |
No | Modified | |
| 2021-08-31 | CVE-2021-35240 | Platform (Orion) / Observability SH | Stored XSS via Help Server settings | 6.5 | High | 2020.2.6 HF1 |
No | Modified | |
| 2021-08-31 | CVE-2021-35239 | Platform (Orion) / Observability SH | Stored XSS in Maps text box hyperlink Vulnerability | 7.5 | Low | 2020.2.6 HF1 |
No | Modified | |
| 2021-08-31 | CVE-2021-35223 | Serv-U | Execute Command Function Allows Remote Code Execution (RCE)Vulnerability | 8.5 | Low | later than 15.2.4 |
No | Modified | |
| 2021-08-31 | CVE-2021-35222 | Platform (Orion) / Observability SH | Resource.aspx Reflected Cross-Site Scripting Vulnerability | 8.0 | None | 2020.2.6 HF1 |
No | Modified | |
| 2021-08-31 | CVE-2021-35221 | Platform (Orion) / Observability SH | ImportAlert Improper Access Control Tampering Vulnerability | 6.3 | Low | 2020.2.6 HF1 |
No | Modified | |
| 2021-08-31 | CVE-2021-35220 | Platform (Orion) / Observability SH | EmailWebPage Command Injection RCE | 8.1 | High | 2020.2.6 HF1 |
No | Modified | |
| 2021-08-31 | CVE-2021-35219 | Platform (Orion) / Observability SH | ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability | 6.0 | High | 2020.2.6 HF1 |
No | Modified | |
| 2021-08-31 | CVE-2021-35213 | Platform (Orion) / Observability SH | Orion User setting Improper Access Control Privilege Escalation Vulnerability | 8.9 | Low | 2020.2.6 |
No | Modified | |
| 2021-08-31 | CVE-2021-35212 | Platform (Orion) / Observability SH | Blind SQL injection Vulnerability | 8.9 | Low | 2020.2.5 HF1 |
No | Modified | |
| 2021-08-26 | CVE-2021-32076 | Web Help Desk | Access Restriction bypass vulnerability via referrer spoof – Business Logic Bypass | 5.3 | None | 12.7.6 |
No | Modified | |
| 2021-07-27 | CVE-2021-28674 | Platform (Orion) / Observability SH | The node management page in SolarWinds Orion Platform before 2020.2.5 HF1 allows an attacker to create or… | 5.4 | Low | n/a |
No | Modified | |
| 2021-07-14 | CVE-2021-35211 | Serv-U | Serv-U Remote Memory Escape Vulnerability | 9.0 | None | 15.2.3 HF2 |
2021-11-03 | Known | Analyzed |
| 2021-07-13 | CVE-2021-31217 | Dameware | In SolarWinds DameWare Mini Remote Control Server 12.0.1.200, insecure file permissions allow file… | 9.1 | None | n/a |
No | Modified | |
| 2021-05-21 | CVE-2021-31475 | Platform (Orion) / Observability SH | This vulnerability allows remote attackers to execute arbitrary code on affected installations of… | 8.8 | Low | later than 2020.2.1 HF2 |
No | Modified | |
| 2021-05-21 | CVE-2021-31474 | Platform (Orion) / Observability SH | This vulnerability allows remote attackers to execute arbitrary code on affected installations of… | 9.8 | None | later than 2020.2.1 |
No | Modified | |
| 2021-05-11 | CVE-2021-32604 | Serv-U | Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail… | 5.4 | Low | n/a |
No | Modified | |
| 2021-05-05 | CVE-2021-25179 | Serv-U | Serv-U before 15.2 is affected by Cross Site Scripting (XSS) via the HTTP Host header. | 6.1 | None | n/a |
No | Modified | |
| 2021-05-05 | CVE-2020-22428 | Serv-U | Serv-U before 15.1.6 Hotfix 3 is affected by Cross Site Scripting (XSS) via a directory name (entered by… | 4.8 | High | n/a |
No | Modified | |
| 2021-05-04 | CVE-2021-3154 | Serv-U | An issue was discovered in SolarWinds Serv-U before 15.2.2. Unauthenticated attackers can retrieve… | 7.5 | None | n/a |
No | Modified | |
| 2021-04-22 | CVE-2021-27277 | Platform (Orion) / Observability SH | This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds… | 7.8 | Low | later than 2020.2 |
No | Modified | |
| 2021-04-14 | CVE-2021-27258 | Platform (Orion) / Observability SH | This vulnerability allows remote attackers to execute escalate privileges on affected installations of… | 9.8 | None | later than 2020.2 |
No | Modified | |
| 2021-03-29 | CVE-2021-27240 | Patch Manager | This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds… | 7.8 | Low | later than 2020.2.1 |
No | Modified | |
| 2021-03-26 | CVE-2021-3109 | Platform (Orion) / Observability SH | The custom menu item options page in SolarWinds Orion Platform before 2020.2.5 allows Reverse Tabnabbing… | 4.8 | High | n/a |
No | Modified | |
| 2021-03-26 | CVE-2020-35856 | Platform (Orion) / Observability SH | Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page. | 4.8 | High | n/a |
No | Modified | |
| 2021-02-11 | CVE-2020-27869 | Platform (Orion) / Observability SH | This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds… | 8.8 | Low | later than 2020.2 |
No | Modified | |
| 2021-02-10 | CVE-2020-27871 | Platform (Orion) / Observability SH | This vulnerability allows remote attackers to create arbitrary files on affected installations of… | 7.2 | High | later than 2020.2.1 |
No | Modified | |
| 2021-02-10 | CVE-2020-27870 | Platform (Orion) / Observability SH | This vulnerability allows remote attackers to disclose sensitive information on affected installations of… | 6.5 | Low | later than 2020.2.1 |
No | Modified | |
| 2021-02-03 | CVE-2021-25276 | Serv-U | In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that… | 7.1 | Low | n/a |
No | Modified | |
| 2021-02-03 | CVE-2021-25275 | Platform (Orion) / Observability SH | Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server… | 7.8 | Low | n/a |
No | Modified | |
| 2021-02-03 | CVE-2021-25274 | Platform (Orion) / Observability SH | The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and… | 9.8 | None | n/a |
No | Modified | |
| 2021-02-03 | CVE-2020-35482 | Serv-U | Serv-U before 15.2.2 allows authenticated reflected XSS. | 5.4 | Low | n/a |
No | Modified | |
| 2021-02-03 | CVE-2020-35481 | Serv-U | Serv-U before 15.2.2 allows Unauthenticated Macro Injection. | 9.8 | None | n/a |
No | Modified | |
| 2021-02-03 | CVE-2020-28001 | Serv-U | Serv-U before 15.2.2 allows Authenticated Stored XSS. | 5.4 | Low | n/a |
No | Modified | |
| 2021-02-03 | CVE-2020-27994 | Serv-U | Serv-U before 15.2.2 allows Authenticated Directory Traversal. | 6.5 | Low | n/a |
No | Modified | |
| 2021-01-15 | CVE-2019-16961 | Web Help Desk | Web Help Desk 12.7.0 allows XSS via a Schedule Name. | 5.4 | Low | n/a |
No | Modified | |
| 2021-01-06 | CVE-2019-16954 | Web Help Desk | Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket. | 5.4 | Low | n/a |
No | Modified | |
| 2021-01-04 | CVE-2019-16960 | Web Help Desk | Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field. | 5.4 | Low | n/a |
No | Modified | |
| 2021-01-04 | CVE-2019-16956 | Web Help Desk | Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket. | 5.4 | Low | n/a |
No | Modified | |
| 2020-12-29 | CVE-2020-10148 | Platform (Orion) / Observability SH | Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands | 9.8 | None | 2019.4 HF6 |
2021-11-03 | Unknown | Analyzed |
| 2020-12-21 | CVE-2019-16959 | Web Help Desk | Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket. | 6.5 | Low | n/a |
No | Modified | |
| 2020-12-18 | CVE-2019-16957 | Web Help Desk | Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account. | 5.4 | Low | n/a |
No | Modified | |
| 2020-12-18 | CVE-2019-16955 | Web Help Desk | Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request. | 5.4 | Low | n/a |
No | Modified | |
| 2020-12-15 | CVE-2018-16243 | DPA and SQL Sentry | Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities,… | 5.4 | Low | n/a |
No | Modified | |
| 2020-12-01 | CVE-2019-16958 | Web Help Desk | Cross-site Scripting (XSS) vulnerability in SolarWinds Web Help Desk 12.7.0 allows attacker to inject… | 5.4 | Low | n/a |
No | Modified | |
| 2020-09-17 | CVE-2020-13169 | Platform (Orion) / Observability SH | Stored XSS (Cross-Site Scripting) exists in the SolarWinds Orion Platform before before 2020.2.1 on… | 9.0 | Low | n/a |
No | Modified | |
| 2020-07-07 | CVE-2020-15576 | Serv-U | Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response. | 7.5 | None | n/a |
No | Modified | |
| 2020-07-07 | CVE-2020-15575 | Serv-U | Serv-U File Server before 15.2.1 allows XSS as demonstrated by Tenable Scan, aka Case Number 00484194. | 6.1 | None | n/a |
No | Modified | |
| 2020-07-07 | CVE-2020-15574 | Serv-U | Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case Number 00331893. | 7.5 | None | n/a |
No | Modified | |
| 2020-07-07 | CVE-2020-15573 | Serv-U | Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421. | 6.1 | None | n/a |
No | Modified | |
| 2020-07-05 | CVE-2020-15543 | Serv-U | Serv-U FTP server before 15.2.1 does not validate an argument path. | 9.8 | None | n/a |
No | Modified | |
| 2020-07-05 | CVE-2020-15542 | Serv-U | Serv-U FTP server before 15.2.1 mishandles the CHMOD command. | 9.8 | None | n/a |
No | Modified | |
| 2020-07-05 | CVE-2020-15541 | Serv-U | Serv-U FTP server before 15.2.1 allows remote command execution. | 9.8 | None | n/a |
No | Modified | |
| 2020-06-24 | CVE-2020-14007 | Platform (Orion) / Observability SH | Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via… | 5.4 | Low | n/a |
No | Modified | |
| 2020-06-24 | CVE-2020-14006 | Platform (Orion) / Observability SH | Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via… | 5.4 | Low | n/a |
No | Modified | |
| 2020-06-24 | CVE-2020-14005 | Platform (Orion) / Observability SH | Solarwinds Orion (with Web Console WPM 2019.4.1, and Orion Platform HF4 or NPM HF2 2019.4) allows remote… | 8.8 | Low | n/a |
No | Modified | |
| 2020-05-04 | CVE-2019-12864 | Platform (Orion) / Observability SH | Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) is vulnerable to Information Leakage, because of… | 5.5 | Low | n/a |
No | Modified | |
| 2020-04-27 | CVE-2019-20002 | Web Help Desk | Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a value (provided by a… | 7.8 | None | n/a |
No | Modified | |
| 2020-04-07 | CVE-2020-5734 | Dameware | Classic buffer overflow in SolarWinds Dameware allows a remote, unauthenticated attacker to cause a denial… | 7.5 | None | later than 12.1 HF3 |
No | Modified | |
| 2020-03-18 | CVE-2019-12769 | Serv-U | Serv-U Managed File Transfer (MFT) Web client before 15.1.6 Hotfix 2 is vulnerable to Cross-Site Request… | 8.8 | None | n/a |
No | Modified | |
| 2020-02-25 | CVE-2019-12863 | Platform (Orion) / Observability SH | Orion Platform 2018.4 HF3 (NPM 12.4, NetPath 1.1.4) allows Stored HTML Injection by administrators via the… | 4.8 | High | n/a |
No | Modified | |
| 2020-02-17 | CVE-2019-12954 | Platform (Orion) / Observability SH | Network Performance Monitor (Orion Platform 2018, NPM 12.3, NetPath 1.1.3) allows XSS by authenticated… | 5.4 | Low | n/a |
No | Modified | |
| 2020-01-17 | CVE-2019-17127 | Platform (Orion) / Observability SH | A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion… | 6.1 | None | n/a |
No | Modified | |
| 2020-01-17 | CVE-2019-17125 | Platform (Orion) / Observability SH | A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion… | 6.1 | None | n/a |
No | Modified | |
| 2019-12-18 | CVE-2019-19829 | Serv-U | A cross-site scripting (XSS) vulnerability exists in SolarWinds Serv-U FTP Server 15.1.7 in the email… | 5.4 | Low | n/a |
No | Modified | |
| 2019-12-16 | CVE-2019-13182 | Serv-U | A stored cross-site scripting (XSS) vulnerability exists in the web UI of SolarWinds Serv-U FTP Server 15.1.7. | 5.4 | Low | n/a |
No | Modified | |
| 2019-12-16 | CVE-2019-13181 | Serv-U | A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7. | 6.5 | Low | n/a |
No | Modified | |
| 2019-10-08 | CVE-2019-3980 | Dameware | The Solarwinds Dameware Mini Remote Client agent v12.1.0.89 supports smart card authentication which can… | 9.8 | None | later than 12.1.0.89 |
No | Modified | |
| 2019-08-14 | CVE-2018-19386 | DPA and SQL Sentry | Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError… | 6.1 | None | n/a |
No | Modified | |
| 2019-07-16 | CVE-2018-13442 | Platform (Orion) / Observability SH | Network Performance Monitor 12.3 allows SQL Injection via the… | 8.8 | Low | n/a |
No | Modified | |
| 2019-06-17 | CVE-2019-12181 | Serv-U | A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux. | 8.8 | Low | n/a |
No | Modified | |
| 2019-06-07 | CVE-2019-3957 | Dameware | Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer… | 7.4 | None | later than 12.1.0.34 |
No | Modified | |
| 2019-06-07 | CVE-2018-19999 | Serv-U | The local management interface in SolarWinds Serv-U FTP Server 15.1.6.25 has incorrect access controls… | 7.8 | Low | n/a |
No | Modified | |
| 2019-05-02 | CVE-2019-9017 | Dameware | DWRCC in SolarWinds DameWare Mini Remote Control 10.0 x64 has a Buffer Overflow associated with the size… | 7.5 | None | n/a |
No | Modified | |
| 2019-03-17 | CVE-2018-19934 | Serv-U | Serv-U FTP Server 15.1.6.25 has reflected cross-site scripting (XSS) in the Web management interface via… | 4.8 | High | n/a |
No | Modified | |
| 2019-03-17 | CVE-2018-15906 | Serv-U | Serv-U FTP Server 15.1.6 allows remote authenticated users to execute arbitrary code by using the Import… | 7.2 | High | n/a |
No | Modified | |
| 2019-03-01 | CVE-2019-9546 | Platform (Orion) / Observability SH | Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service. | 9.8 | None | n/a |
No | Modified | |
| 2019-02-18 | CVE-2019-8917 | Platform (Orion) / Observability SH | Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine… | 9.8 | None | n/a |
No | Modified | |
| 2018-12-05 | CVE-2018-16792 | Kiwi, TFTP, other | SFTP/SCP server through 2018-09-10 is vulnerable to XXE via a world readable and writable configuration… | 9.1 | None | n/a |
No | Modified | |
| 2018-12-05 | CVE-2018-16791 | Kiwi, TFTP, other | In SolarWinds SFTP/SCP Server through 2018-09-10, the configuration file is world readable and writable,… | 9.8 | None | n/a |
No | Modified | |
| 2018-09-07 | CVE-2018-12897 | Dameware | DameWare Mini Remote Control before 12.1 has a Buffer Overflow. | 7.8 | Low | n/a |
No | Modified | |
| 2018-05-16 | CVE-2018-10241 | Serv-U | A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to… | 6.5 | Low | n/a |
No | Modified | |
| 2018-05-16 | CVE-2018-10240 | Serv-U | Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included… | 7.3 | None | n/a |
No | Modified | |
| 2017-12-20 | CVE-2012-2576 | Kiwi, TFTP, other | SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2,… | 9.8 | None | n/a |
No | Modified | |
| 2017-10-02 | CVE-2017-9538 | Platform (Orion) / Observability SH | The 'Upload logo from external path' function of SolarWinds Network Performance Monitor version… | 4.9 | High | n/a |
No | Modified | |
| 2017-10-02 | CVE-2017-9537 | Platform (Orion) / Observability SH | Persistent cross-site scripting (XSS) in the Add Node function of SolarWinds Network Performance Monitor… | 4.8 | High | n/a |
No | Modified | |
| 2017-04-12 | CVE-2017-7722 | Security Event Manager | In SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4, a menu system is encountered when the SSH… | 10.0 | None | n/a |
No | Modified | |
| 2017-04-10 | CVE-2017-7647 | Security Event Manager | Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to execute arbitrary commands. | 8.8 | Low | n/a |
No | Modified | |
| 2017-04-10 | CVE-2017-7646 | Security Event Manager | Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to browse the server's… | 6.5 | Low | n/a |
No | Modified | |
| 2017-03-24 | CVE-2017-5199 | Security Event Manager | The editbanner feature in SolarWinds LEM (aka SIEM) through 6.3.1 allows remote authenticated users to… | 8.8 | Low | n/a |
No | Modified | |
| 2017-03-24 | CVE-2017-5198 | Security Event Manager | LEM (aka SIEM) before 6.3.1 has an incorrect sudo configuration, which allows local users to obtain root… | 8.8 | Low | n/a |
No | Modified | |
| 2017-03-20 | CVE-2017-6803 | Kiwi, TFTP, other | Multiple cross-site request forgery (CSRF) vulnerabilities in the web interface in the Scheduler in… | 8.8 | None | n/a |
No | Modified | |
| 2016-06-24 | CVE-2016-5709 | Kiwi, TFTP, other | Virtualization Manager 6.3.1 and earlier uses weak encryption to store passwords in /etc/shadow, which… | 4.7 | Low | n/a |
No | Modified | |
| 2016-06-17 | CVE-2016-3643 | Kiwi, TFTP, other | Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by using a misconfiguration… | 7.8 | Low | n/a |
2021-11-03 | Unknown | Analyzed |
| 2016-06-17 | CVE-2016-3642 | Kiwi, TFTP, other | The RMI service in SolarWinds Virtualization Manager 6.3.1 and earlier allows remote attackers to execute… | 9.8 | None | n/a |
No | Modified | |
| 2016-05-09 | CVE-2016-4350 | Kiwi, TFTP, other | Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource… | 9.8 | None | n/a |
No | Modified | |
| 2016-03-17 | CVE-2016-2345 | Dameware | Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control… | 9.8 | None | n/a |
No | Modified | |
| 2015-11-17 | CVE-2015-8220 | Dameware | Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control… | 7.5 | N/A | n/a |
No | Modified | |
| 2015-10-15 | CVE-2015-7840 | Security Event Manager | The command line management console (CMC) in SolarWinds Log and Event Manager (LEM) before 6.2.0 allows… | 7.5 | N/A | n/a |
No | Modified | |
| 2015-10-15 | CVE-2015-7839 | Security Event Manager | Log and Event Manager (LEM) allows remote attackers to execute arbitrary commands on managed computers via… | 7.5 | N/A | n/a |
No | Modified | |
| 2015-10-15 | CVE-2015-7838 | Kiwi, TFTP, other | ProcessFileUpload.jsp in SolarWinds Storage Manager before 6.2 allows remote attackers to upload and… | 10.0 | N/A | n/a |
No | Modified | |
| 2015-07-06 | CVE-2015-5371 | Kiwi, TFTP, other | The AuthenticationFilter class in SolarWinds Storage Manager allows remote attackers to upload and execute… | 10.0 | N/A | n/a |
No | Modified | |
| 2015-03-24 | CVE-2015-2284 | Kiwi, TFTP, other | userlogin.jsp in SolarWinds Firewall Security Manager (FSM) before 6.6.5 HotFix1 allows remote attackers… | 10.0 | N/A | n/a |
No | Modified | |
| 2015-03-10 | CVE-2014-9566 | NCM | Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service… | 7.5 | N/A | n/a |
No | Modified | |
| 2015-02-16 | CVE-2015-1501 | Platform (Orion) / Observability SH | The factory.loadExtensionFactory function in TSUnicodeGraphEditorControl in SolarWinds Server and… | 6.8 | N/A | n/a |
No | Modified | |
| 2015-02-16 | CVE-2015-1500 | Platform (Orion) / Observability SH | Multiple stack-based buffer overflows in the TSUnicodeGraphEditorControl in SolarWinds Server and… | 6.8 | N/A | n/a |
No | Modified | |
| 2014-09-04 | CVE-2014-5504 | Security Event Manager | Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for remote attackers to… | 7.5 | N/A | n/a |
No | Modified | |
| 2014-08-07 | CVE-2014-3459 | NCM | Heap-based buffer overflow in SolarWinds Network Configuration Manager (NCM) before 7.3 allows remote… | 6.8 | N/A | n/a |
No | Modified | |
| 2014-03-20 | CVE-2013-3249 | Dameware | Stack-based buffer overflow in the "Add from text file" feature in the DameWare Exporter tool… | 9.3 | N/A | n/a |
No | Modified | |
| 2012-10-31 | CVE-2012-4939 | Platform (Orion) / Observability SH | Cross-site scripting (XSS) vulnerability in IPAMSummaryView.aspx in the IPAM web interface before… | 4.3 | N/A | n/a |
No | Modified | |
| 2012-08-12 | CVE-2012-2602 | Platform (Orion) / Observability SH | Multiple cross-site request forgery (CSRF) vulnerabilities in SolarWinds Orion Network Performance Monitor… | 6.8 | N/A | n/a |
No | Modified | |
| 2012-08-12 | CVE-2012-2577 | Platform (Orion) / Observability SH | Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM)… | 4.3 | N/A | n/a |
No | Modified | |
| 2011-12-14 | CVE-2011-4800 | Serv-U | Directory traversal vulnerability in Serv-U FTP Server before 11.1.0.5 allows remote authenticated users… | 9.0 | N/A | n/a |
No | Modified | |
| 2011-08-24 | CVE-2010-4828 | Platform (Orion) / Observability SH | Multiple cross-site scripting (XSS) vulnerabilities in SolarWinds Orion Network Performance Monitor (NPM)… | 4.3 | N/A | n/a |
No | Modified | |
| 2010-06-16 | CVE-2010-2310 | Kiwi, TFTP, other | TFTP Server 10.4.0.13 allows remote attackers to cause a denial of service (crash) via a long write request. | 5.0 | N/A | n/a |
No | Modified | |
| 2010-05-28 | CVE-2010-2115 | Kiwi, TFTP, other | TFTP Server 10.4.0.10 allows remote attackers to cause a denial of service (no new connections) via a… | 5.0 | N/A | n/a |
No | Modified | |
| 2010-04-27 | CVE-2009-4815 | Serv-U | Directory traversal vulnerability in Serv-U before 9.2.0.1 allows remote authenticated users to read… | 4.0 | N/A | n/a |
No | Modified | |
| 2009-11-20 | CVE-2009-4006 | Serv-U | Stack-based buffer overflow in the TEA decoding algorithm in RhinoSoft Serv-U FTP server 7.0.0.1, 9.0.0.5,… | 10.0 | N/A | n/a |
No | Modified | |
| 2009-10-09 | CVE-2009-3655 | Serv-U | Rhino Software Serv-U 7.0.0.1 through 8.2.0.3 allows remote attackers to cause a denial of service (server… | 5.0 | N/A | n/a |
No | Modified | |
| 2009-09-09 | CVE-2009-3115 | Kiwi, TFTP, other | TFTP Server 9.2.0.111 and earlier allows remote attackers to cause a denial of service (service stop) via… | 5.0 | N/A | n/a |
No | Modified | |
| 2009-03-20 | CVE-2009-1031 | Serv-U | Directory traversal vulnerability in the FTP server in Rhino Software Serv-U File Server 7.0.0.1 through… | 7.8 | N/A | n/a |
No | Modified | |
| 2009-03-19 | CVE-2009-0967 | Serv-U | The FTP server in Serv-U 7.0.0.1 through 7.4.0.1 allows remote authenticated users to cause a denial of… | 4.0 | N/A | n/a |
No | Modified | |
| 2008-10-08 | CVE-2008-4501 | Serv-U | Directory traversal vulnerability in the FTP server in Serv-U 7.0.0.1 through 7.3, including 7.2.0.1,… | 9.0 | N/A | n/a |
No | Modified | |
| 2008-10-08 | CVE-2008-4500 | Serv-U | Serv-U 7.0.0.1 through 7.3, including 7.2.0.1, allows remote authenticated users to cause a denial of… | 4.0 | N/A | n/a |
No | Modified | |
| 2008-08-20 | CVE-2008-3731 | Serv-U | Unspecified vulnerability in Serv-U File Server 7.0.0.1, and other versions before 7.2.0.1, allows remote… | 4.0 | N/A | n/a |
No | Modified | |
| 2006-04-24 | CVE-2006-1951 | Kiwi, TFTP, other | Directory traversal vulnerability in SolarWinds TFTP Server 8.1 and earlier allows remote attackers to… | 5.0 | N/A | n/a |
No | Modified | |
| 2005-11-02 | CVE-2005-3467 | Serv-U | Serv-U FTP Server before 6.1.0.4 allows attackers to cause a denial of service (crash) via (1) malformed… | 5.0 | N/A | n/a |
No | Modified | |
| 2004-12-31 | CVE-2004-2533 | Serv-U | Serv-U FTP Server 4.1 (possibly 4.0) allows remote attackers to cause a denial of service (application… | 5.0 | N/A | n/a |
No | Modified | |
| 2004-12-31 | CVE-2004-2532 | Serv-U | Serv-U FTP server before 5.1.0.0 has a default account and password for local administration, which allows… | 10.0 | N/A | n/a |
No | Modified | |
| 2004-12-31 | CVE-2004-2111 | Serv-U | Stack-based buffer overflow in the site chmod command in Serv-U FTP Server before 4.2 allows remote… | 8.5 | N/A | n/a |
No | Modified | |
| 2004-09-11 | CVE-2004-1675 | Serv-U | Serv-U FTP server 4.x and 5.x allows remote attackers to cause a denial of service (application crash) via… | 5.0 | N/A | n/a |
No | Modified | |
| 2004-04-20 | CVE-2004-1992 | Serv-U | Buffer overflow in Serv-U FTP server before 5.0.0.6 allows remote attackers to cause a denial of service… | 5.0 | N/A | n/a |
No | Modified | |
| 2004-03-23 | CVE-2004-1852 | Dameware | DameWare Mini Remote Control 3.x before 3.74 and 4.x before 4.2 transmits the Blowfish encryption key in… | 5.0 | N/A | n/a |
No | Modified | |
| 2004-03-18 | CVE-2004-0330 | Serv-U | Buffer overflow in Serv-U ftp before 5.0.0.4 allows remote authenticated users to execute arbitrary code… | 10.0 | N/A | n/a |
No | Modified | |
| 2003-03-18 | CVE-2002-1542 | Kiwi, TFTP, other | TFTP server 5.0.55 and earlier allows remote attackers to cause a denial of service (crash) via a large… | 5.0 | N/A | n/a |
No | Modified | |
| 2002-12-31 | CVE-2002-2393 | Serv-U | Serv-U FTP server 3.0, 3.1 and 4.0.0.4 does not accept new connections while validating user folder access… | 5.0 | N/A | n/a |
No | Modified | |
| 2002-10-29 | CVE-2002-1209 | Kiwi, TFTP, other | Directory traversal vulnerability in SolarWinds TFTP Server 5.0.55, and possibly earlier, allows remote… | 5.0 | N/A | n/a |
No | Modified | |
| 2001-11-19 | CVE-2001-1463 | Serv-U | The remote administration client for RhinoSoft Serv-U 3.0 sends the user password in plaintext even when… | 7.5 | N/A | n/a |
No | Modified | |
| 2001-02-16 | CVE-2001-0054 | Serv-U | Directory traversal vulnerability in FTP Serv-U before 2.5i allows remote attackers to escape the FTP root… | 5.0 | N/A | n/a |
No | Modified |
Red rows are in CISA KEV. “Fixed in” is the first version in the solutions field of SolarWinds’ CVE record; “later than X” means the record gives only the last affected version. 116 older records, mostly filed by MITRE before SolarWinds became a CNA, name no fixed version. Issue text is SolarWinds’ CVE title where one exists, otherwise the start of the NVD description.
What this means for MSPs
Treat Web Help Desk as internet-exposed critical infrastructure. Five of its CVEs are in KEV, and SolarWinds’ own records show two successive deserialization fixes (for CVE-2024-28986 and CVE-2024-28988) were bypassed. Anything older than WHD 2026.1 is exposed to CVE-2025-40551; CVE-2026-28323 (SAML bypass, 9.8, only when SAML 2.0 login is on) needs 2026.2.1.
Move Serv-U to 2026.3. That one release closes the 15 July 2026 CVEs, and 15.5.4 HF1 is the minimum for KEV-listed CVE-2026-28318. Our analysis of RMM vulnerabilities shows the same pattern of remote-access tools reaching KEV within days.
Patch Dameware this month. CVE-2026-28336 (9.9) lets an authenticated user compromise the host Dameware controls; SolarWinds names Dameware 2026.3.1 as the fix.
Check non-default configurations on Observability Self-Hosted. CVE-2026-28324 (9.8) and CVE-2026-28325 (8.8) are unauthenticated RCEs that SolarWinds says hit only non-default or specific communication-mode setups; both are fixed in 2026.2.3, and 2026.4 fixes the October batch.
Do not wait for NVD. 12 of this year’s SolarWinds CVEs are still unanalyzed in NVD. SolarWinds’ CVE records on cve.org carry the fixed versions on day one.
Frequently asked questions
What is the latest SolarWinds vulnerability?
As of November 13, 2026, the newest SolarWinds CVEs are three Dameware flaws published November 3, 2026: CVE-2026-28336 (CVSS 9.9, command injection, authentication required), CVE-2026-28335 (8.4) and CVE-2026-28327 (8.2). SolarWinds’ CVE records name Dameware 2026.3.1 as the fix. The newest SolarWinds entry in CISA KEV is CVE-2026-28318, a Serv-U denial of service added June 5, 2026.
What is the current vulnerability in SolarWinds Orion?
SolarWinds’ CVE records since June 2025 name the Orion line SolarWinds Observability Self-Hosted, where earlier records said SolarWinds Platform or Orion Platform. Its most recent critical CVE is CVE-2026-28324 (CVSS 9.8, unauthenticated remote code execution in a non-default configuration), published September 22, 2026 and fixed in 2026.2.3. The October 20, 2026 batch (CVE-2026-28328 to 28330) is fixed in 2026.4. The only Orion CVE in CISA KEV is CVE-2020-10148, the API authentication bypass from December 2020.
Which SolarWinds vulnerabilities are actively exploited?
CISA’s KEV catalog (version 2026.11.10) lists 11 SolarWinds CVEs: 5 in Web Help Desk, 4 in Serv-U, 1 in Orion and 1 in Virtualization Manager. Four were added in 2026: CVE-2025-40551, CVE-2025-40536, CVE-2025-26399 and CVE-2026-28318. CISA flags CVE-2021-35211 and CVE-2025-26399 as used in ransomware campaigns.
What was the SolarWinds attack, explained simply?
In 2020 attackers broke into SolarWinds’ software build system and inserted malicious code (SUNBURST) into Orion updates shipped between March and June 2020, per SolarWinds’ December 14, 2020 8-K. About 33,000 Orion customers were notified and fewer than 18,000 were believed to have installed a tainted build. The US government attributed it to Russia’s SVR on April 15, 2021. It was a supply-chain compromise, not a product bug, so it has no CVE.
Did the SEC file a lawsuit against SolarWinds?
Yes. On October 30, 2023 the SEC charged SolarWinds and its CISO, Timothy G. Brown, with fraud and internal control failures tied to SUNBURST disclosures. A July 18, 2024 ruling (741 F. Supp. 3d 37) granted the defendants’ motion to dismiss in part. On November 20, 2025 the SEC filed a joint stipulation dismissing the remaining case with prejudice (Litigation Release 26423).
Do people still use SolarWinds?
Yes. SolarWinds went private on April 16, 2025, when Turn/River Capital’s acquisition closed at $18.50 per share (SolarWinds 8-K). The company still publishes CVE records as a CNA: 42 of the 43 SolarWinds CVEs published in 2026 came from SolarWinds itself, with fixes such as Serv-U 2026.3 and Observability Self-Hosted 2026.4.
Download the data. solarwinds-vulnerabilities-2001-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.
Free to cite and republish with a link.
Methodology
Sources. NIST NVD API 2.0, pulled November 13, 2026 three ways: keyword “SolarWinds”, CPE vendor solarwinds, and source identifier psirt@solarwinds.com (351 unique CVEs before exclusions). CVE JSON 5 records for each ID from the CVE Program’s cvelistV5 repository, for SolarWinds’ own titles, solutions and CVSS vectors. CISA KEV catalog version 2026.11.10. CISA ED 21-01 and advisory AA20-352A, the Treasury release of April 15, 2021, SEC press release 2023-227 and Litigation Release 26423, and SolarWinds 8-K filings of December 14, 2020 and April 16, 2025 on EDGAR. This product uses data from the NVD API but is not endorsed or certified by the NVD.
Scope. A CVE counts if NVD lists a SolarWinds CPE for it, or if SolarWinds filed it, or if the description names a SolarWinds product. Products are grouped into 11 families by CPE and CNA product name. The 12 CVEs in N-central, the MSP Patch Management Engine and the Advanced Monitoring Agent (N-able since its 2021 spin-off) are kept in the CSV but left out of the 338. CVE-2022-47012 (GNS3 dynamips, filed under a SolarWinds CPE in NVD) is excluded.
Definitions. First public CVE record is the earlier of the cvelistV5 datePublished and the NVD published date. Same window means January 1 to November 13. Critical means base score 9.0 or higher, preferring SolarWinds’ score, then NVD’s primary score, then any other. Days to KEV run from first record to KEV dateAdded; the federal deadline is KEV dueDate minus dateAdded.
Limitations. KEV shows confirmed exploitation, not all exploitation, and its ransomware field can change later. The three entries added on November 3, 2021 reflect the catalog’s launch. Fixed versions are extracted from SolarWinds’ CVE text by pattern, so check the vendor advisory before upgrading. We did not test any product.
Terms. solarwinds.com’s terms of use limit site content to non-commercial personal use, so we did not fetch or reproduce SolarWinds web pages; SolarWinds’ statements here come from the CVE records it publishes to the CVE Program and from its SEC filings. NVD, CISA, Treasury and SEC material is US government work. The CSV is CC BY 4.0.
Not advice. This is an analysis of public records, not a remediation plan for any environment.
Cite as:The Uptime Report. "SolarWinds Vulnerabilities: 43 CVEs in 2026 and 4 Added to CISA KEV, the Most in Any Year." November 2026. https://theuptimereport.com/solarwinds-vulnerabilities/
References
- NIST, National Vulnerability Database, CVE API 2.0. Accessed November 2026.
- CVE Program, cvelistV5 repository (CVE JSON 5 records filed by SolarWinds as CNA). Accessed November 2026.
- CISA, Known Exploited Vulnerabilities Catalog. Accessed November 2026.
- CISA, Emergency Directive 21-01: Mitigate SolarWinds Orion Code Compromise. Accessed November 2026.
- CISA, AA20-352A, Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations. Accessed November 2026.
- US Treasury, Treasury Sanctions Russia with Sweeping New Sanctions Authority, April 15, 2021. Accessed November 2026.
- SolarWinds Corporation, Form 8-K, December 14, 2020. Accessed November 2026.
- SolarWinds Corporation, Form 8-K, April 16, 2025 (completion of merger). Accessed November 2026.
- SEC, Press Release 2023-227, SEC Charges SolarWinds and Chief Information Security Officer. Accessed November 2026.
- SEC, Litigation Release No. 26423, November 20, 2025 and joint stipulation to dismiss. Accessed November 2026.
- CVE-2025-26399 record; CVE-2025-40551; CVE-2026-28318; CVE-2026-28336; CVE-2026-28324; CVE-2020-10148. Accessed November 2026.
Research library
More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research
Threats and breaches
- AT&T Data Breach Settlement Payout Date
AT&T payout status, tiers, incident history - Microsoft Data Breach History
Microsoft incidents by type, 2020 to 2026 - IC3 Report 2025
IC3 losses, crime types, states per capita - AI Incidents Statistics 2026
AI incidents by year, harm type, company - Cyber Attacks 2026
Every 2026 cyber attack, primary-sourced - WordPress Vulnerabilities
WordPress plugin, theme and core CVEs - Hypervisor Vulnerabilities
Hypervisor CVEs vs exploitation - DMARC Adoption Statistics 2026
DMARC enforcement, 15,000 domains - RMM Vulnerabilities and Remote Access Flaws
RMM and remote access flaws in KEV - Identity Theft Statistics 2026
ID theft per 100K by state and type - Scam Statistics 2026
FTC fraud losses by channel and age - VPN Vulnerabilities by Vendor
VPN gateway KEV and CVEs by vendor - MFA Statistics 2026
MFA methods across 2,571 services - Password Statistics 2026
12,674 passwords tested against HIBP - Ransomware Groups 2026
Most active ransomware groups, ranked - Ransomware Statistics 2026
Leak-site victims by month since 2021 - Malicious npm Packages
Malicious npm packages, day by day - Cybersecurity Statistics 2026
70 sourced stats, every number traced - Zero-Day Statistics
Every tracked zero-day since 2014 - Phishing Statistics 2026
Four phishing measures, one evidence board - Patch Tuesday Statistics 2026
Every Microsoft CVE since 2021 - Disaster Declarations by State
FEMA data for continuity planning - Data Breach Statistics 2026
980 breaches in Have I Been Pwned - Ransomware Initial Access Vectors
CISA advisories coded by entry technique - CVE Statistics 2026
Vulnerabilities published per year, NIST NVD - How Long Do Companies Take to Report a Data Breach?
1,675 Washington notices - Known Exploited Vulnerabilities
The CISA KEV catalog analyzed - Healthcare Data Breach Report 2026
HHS OCR breach portal scorecard - Ransomware Reported to the FBI
Five-year IC3 trend - ConnectWise ScreenConnect Vulnerabilities
ScreenConnect CVEs dated, with version lookup - SonicWall Vulnerabilities 2026
SonicWall CVEs by product line and KEV year - Dental Practice Data Breaches 2026
Every 2026 dental breach on the HHS portal - Apple Zero Days 2026 List
Every Apple-flagged CVE, with KEV dates - Android Zero Days 2026
Android flags by layer, OEM patch lag - Auto Dealership Data Breach 2026 Tracker
Dealer and vendor breaches by state filing - Law Firm Data Breaches 2026
Every law firm AG notice, sized and dated - Accounting Firm Data Breach 2026
CPA breach notices against the tax calendar - Bank DMARC Adoption 2026
DMARC at 4,118 US banks, by size - MSP Email Security
MSP DMARC and SPF, 1,430 domains - Credit Union Cybersecurity Statistics 2026
55% of credit unions skip DMARC - Citrix NetScaler Vulnerabilities 2026
48 NetScaler CVEs, 6 exploited, build checker - Fortinet Vulnerabilities 2026
Every 2026 Fortinet CVE, by product - Okta Vulnerabilities
Okta CVEs and incidents, two ledgers - Veeam Vulnerabilities
Veeam CVEs, fixed builds, KEV flags - Atlassian Confluence Vulnerabilities
Confluence CVEs, KEV and LTS fixes - SAP NetWeaver Vulnerabilities
Every SAP NetWeaver CVE, by Patch Day - N-able Vulnerabilities
N-able CVEs, fixed builds and KEV flags
Infrastructure and uptime
- Data Centers Using Nuclear Power
Every US nuclear deal, by NRC stage - Claude Outage History
934 Claude incidents by model and hour - AMD vs Nvidia Market Share Over Time
AMD vs Nvidia share: Steam and SEC filings - iPhone Market Share by Country 2026
iPhone share in every country - Android Market Share by Version 2026
Android versions and patch status - OpenAI Outage History
1,051 OpenAI incidents, causes coded - Data Center Construction Spending 2026
Data center build spending, Census monthly - Microsoft End of Support 2026
Every 2026 Microsoft support cutoff - Fiber Internet Availability by State 2026
Fiber by state, build pace, top providers - 5G Coverage Map 2026
5G by state and carrier, FCC data - Cell Phone Outage History
FCC outages, DIRS cell sites, 911 fines - Mac Market Share 2026
Mac desktop share by country and version - Browser Market Share 2026
Browser share since 2009, by platform - Microsoft 365 Market Share 2026
Who runs email: Microsoft vs Google - CrowdStrike Outage
July 19, 2024 outage, minute by minute - Data Center Electricity Prices 2026
Power prices vs data center load, by state - Average Internet Bill 2026
Home internet prices by speed and state - Search Engine Market Share 2026
Search share since 2009, by country - ChatGPT Market Share 2026
AI chatbot referral share, every tracker - Google Cloud Outage History
Google Cloud incidents by product, 2013 on - Azure Outage History
Every Azure PIR, coded by root cause - Data Center Water Usage 2026
Water by site, company and drought - AI Energy Consumption 2026
Big Tech electricity vs US demand - SSD Prices 2026
NAND price cycle from makers’ filings - RAM Prices 2026
DRAM prices from producers’ filings - Domain Name Statistics 2026
Domains by TLD, renewals, registrars - Linux Market Share 2026
Linux desktop share, every headline traced - GitHub Outages
GitHub incidents by month since 2020 - Cloudflare Outage History
Every Cloudflare outage post-mortem - Starlink Statistics 2026
Satellites, subscribers, coverage, outages - Internet Access Statistics 2026
Home internet gaps by state and group - SQL Server End of Life
SQL Server support countdown + CVEs - Windows 11 Market Share 2026
Windows 10 vs 11 share by country - Cloud Computing Statistics 2026
Hyperscaler revenue and capex, SEC data - AWS Outage History
Every AWS Post-Event Summary since 2011 - Data Centers by State 2026
Sites, jobs, power for every state - Data Center Statistics 2026
Data center power, spending, jobs - 99.9% Uptime
Uptime calculator and 35 real SLAs - Power Outage Statistics by State
Outage hours by state, EIA data - Cost of Downtime
Revenue per hour for 3,001 public companies - Windows Server End of Life
Support dates and CVEs per server version - SQL Server 2016 ESU Cost
ESU cost calculator, every formula - Slack Outage History
1,459 Slack entries, SLA history, ledger - Google Workspace vs Microsoft 365 in US Schools
Google vs Microsoft in 10,591 districts - Block GPTBot
AI crawler blocks across top 10k sites - security.txt Adoption 2026
Who publishes a valid security.txt - Government Email Security 2026
.gov DMARC: local 40% vs federal 88% - Government Website Security 2026
.gov web security scored by state - vSphere 8 End of Support
vSphere 8 dates, exploited flaws by version - Office 2019 End of Life
Office 2019 EOL: who still gets patches - Zoom Outage History
Every Zoom incident since 2015 - Office 2021 End of Life
177 flaws fixed a month after support ended - Exchange Server 2019 End of Life
Exchange 2019 EOL, ESU builds and CVEs - FortiOS 7.0 End of Life
FortiOS 7.0 dates, builds and unfixed flaws
Regulation and disclosure
- Are Ransomware Payments Illegal? Law by Jurisdiction
Who may pay a ransom, by jurisdiction - HIPAA Security Rule Changes 2026
Security Rule status: current vs proposed - FTC Safeguards Rule Breach Notification
500-consumer, 30-day FTC breach duty - Data Center Moratorium by State 2026
Moratoria and bans in every state - State Privacy Laws 2026
23 state privacy laws, compared - State AI Laws 2026
131 state AI laws, dates and penalties - FedRAMP Statistics 2026
FedRAMP authorizations, GSA data - Item 1C Cybersecurity Disclosures
What 600 10-Ks say in Item 1C - CMMC Certification Statistics 2026
CMMC demand vs assessor capacity - Data Brokers List 2026
728 brokers across three state registries - SEC Cybersecurity Incident Disclosures
Every 8-K Item 1.05 filing - HIPAA Enforcement Tracker
Every OCR penalty and settlement - CMMC Level 2 Assessment Cost
CMMC Level 2 cost estimator, DoD figures - Safe Harbor Cybersecurity Laws by State
10 states, 11 laws, framework grid
Workforce and pay
- Intel Layoff Tracker
Every Intel WARN notice, by site and date - Amazon Layoffs by State
Amazon WARN notices, state by state - Oracle Layoffs by State
Oracle WARN notices and restructuring cost - Cloud Architect vs Cloud Engineer Salary
Architect vs engineer pay, H-1B filings - Entry Level DevOps Engineer Salary
Entry level DevOps pay, H-1B filings - Microsoft Layoff History Timeline
Every round dated, 2009 to 2026 - Google Layoffs by Year
Notices, headcount, severance by year - AI Engineer vs ML Engineer Salary
AI vs ML engineer pay, from H-1B filings - Data Engineer Salary by Experience
Data engineer pay by DOL wage level - Most Popular Programming Languages 2026
Language ranks by country, GitHub data - Computer Science Graduates Per Year
CS degrees per year, IPEDS 2011 to 2024 - Data Scientist Salary 2026
Data scientist pay ladder and metros, BLS - Web Developer Salary 2026
Web dev vs software pay by state, BLS - AI at Work Statistics 2026
Worker AI use: ever, weekly, daily, by job - Network Engineer Salary 2026
Network engineer vs admin pay, BLS - IT Manager Salary 2026
IT manager pay by industry, BLS OEWS - Software Engineer Salary 2026
Developer pay by metro, BLS OEWS - H-1B Statistics 2026
H-1B lottery, employers, and wages - AI Layoffs 2026
AI-blamed job cuts, sourced to filings - Help Desk Salary 2026
Help desk hourly pay, BLS OEWS - Cybersecurity Salary 2026
Security pay percentiles, BLS OEWS - Women in Tech Statistics 2026
Women’s share of tech jobs since 2011 - IT Unemployment Rate 2026
Tech vs national jobless rate, monthly - Tech Job Postings 2026
Tech postings vs 2020, by role and country - Tech Layoffs 2026
Tech layoffs from state WARN notices - Remote Work Statistics 2026
Telework by job, industry, and state - Highest Paying Cities for IT Jobs 2026
Metro pay by role, BLS OEWS - The Tech Job Market in 2026
Openings, quits, hires, layoffs - IT Salaries by State 2026
Pay matrix for four IT roles - IT and Cybersecurity Jobs Outlook 2026
BLS employment projections - Salesforce Layoffs by State
Salesforce WARN notices, state by state - Dell Layoffs by Year
Headcount, severance, notices by year - IBM Layoffs by Year
IBM workforce charges against headcount - Meta Layoffs by Year
Meta rounds, sites and headcount by year - IT Director vs IT Manager Salary
IT director vs manager pay, H-1B filings - Penetration Tester Salary Entry Level
Entry level pen test pay, H-1B filings - Site Reliability Engineer vs DevOps Salary
SRE vs DevOps pay, H-1B filings - Solutions Architect vs Software Engineer Salary
Architect vs engineer pay, Level I to IV - Data Engineer vs Data Analyst Salary
Data engineer vs analyst pay, H-1B ledger - Network Engineer vs System Administrator Salary
Network engineer vs sysadmin pay by state - Security Analyst vs Security Engineer Salary
Analyst vs engineer pay, step by step - Cloud Engineer vs DevOps Engineer Salary
Cloud vs DevOps pay by metro, H-1B - Cisco Layoffs by Year
Cisco cuts by year: charges vs staff - Database Administrator vs Data Engineer Salary
DBA vs data engineer pay, reconciled - Penetration Tester vs Security Engineer Salary
Pen tester vs engineer pay: near tie - Help Desk vs Desktop Support Salary
Help desk vs desktop pay, one BLS code
MSP market and spending
- AI Capex 2026
Big Tech capex vs cash flow, SEC data - Cybersecurity Budget 2027
Federal and CISA cyber budgets, benchmarks - Microsoft 365 Price Increase 2026
Every M365 price change, vs inflation - Computer Prices 2026
Computer price indexes and HS 8471 imports - MSP Market Size 2026
Managed services market, built from Census - Small Business AI Adoption 2026
AI use by firm size, sector, state, Census - Cyber Insurance Statistics
Cyber insurance market, NAIC 2015-2024 - IT Spending by Industry
IT investment by industry, BEA - IT Services Industry Growth 2026
Census revenue by service industry - IT Hourly Rates 2026
Hourly IT labor rates, GSA contracts - VoIP Statistics 2026
Business VoIP vs landlines, FCC - MSP Industry Statistics 2026
Jobs, wages, and firms, BLS QCEW - Federal IT Spending 2026
IT services contracts, USAspending - IT Services Firms by State
Census business patterns atlas - How Much Do MSPs Charge Per User?
Published MSP prices, 1,310 websites - VMware Price Increase Broadcom Timeline
Broadcom VMware changes and revenue, dated - Adobe Price Increase History
Every Adobe price change, vs inflation - Atlassian Price Increase History, 2019 to 2026
Every Atlassian price hike, dated - Zoom Price Increase 2026
Every Zoom price change since 2013
Leave a Reply