SolarWinds vulnerabilities
Vulnerabilities and incidents in SolarWinds products, including Access Rights Manager (ARM), Web Help Desk, Serv-U, and the Orion platform. SolarWinds manages privileged access and IT infrastructure at scale, making its products recurring targets for threat actors.
We track 14 SolarWinds CVEs, 11 of them on CISA's Known Exploited Vulnerabilities catalog (2 flagged for ransomware use). The latest KEV addition is CVE-2026-28318, added .
- CVEs tracked
- 14
- On CISA KEV
- 11
- Ransomware use
- 2
- Rated critical
- 7
Most-exploited SolarWinds products
Latest SolarWinds coverage
Our reporting filed under SolarWinds, plus any story that cites one of its CVEs.
SolarWinds Fixes Two Unauth RCE Flaws in Observability
SolarWinds patches CVE-2026-28324 (CVSS 9.8) and CVE-2026-28325 (CVSS 8.8), two unauthenticated RCE flaws in Observability Self-Hosted. No active exploitation reported.
SolarWinds ARM Hard-Coded Key Allows Unauthenticated RCE
CVE-2026-28326 (CVSS 8.8) in SolarWinds Access Rights Manager through 2026.2 lets unauthenticated attackers execute code. Patch ARM 2026.2.1 is available now.
Known exploited SolarWinds vulnerabilities
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability | [ HIGH ] | 7.5 | 48.0% | ||
| CVE-2025-26399 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 90.6% | ||
| CVE-2025-40536 SolarWinds Web Help Desk Security Control Bypass Vulnerability | [ HIGH ] | 8.1 | 73.6% | ||
| CVE-2025-40551 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 84.2% | ||
| CVE-2024-28987 SolarWinds Web Help Desk Hardcoded Credential Vulnerability | [ CRITICAL ] | 9.1 | 93.3% | ||
| CVE-2024-28986 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 84.6% | ||
| CVE-2024-28995 SolarWinds Serv-U Path Traversal Vulnerability | [ HIGH ] | 8.6 | 99.6% | ||
| CVE-2021-35247 SolarWinds Serv-U Improper Input Validation Vulnerability | [ MEDIUM ] | 4.3 | 3.6% | ||
| CVE-2021-35211 SolarWinds Serv-U Remote Code Execution Vulnerabilityransomware use | [ CRITICAL ] | 9.0 | 91.2% | ||
| CVE-2020-10148 SolarWinds Orion Authentication Bypass Vulnerability | [ CRITICAL ] | 9.8 | 92.0% | ||
| CVE-2016-3643 SolarWinds Virtualization Manager Privilege Escalation Vulnerability | [ HIGH ] | 7.8 | 3.7% |
Every SolarWinds CVE on CISA's KEV catalog that we hold, newest KEV addition first. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else.
Other SolarWinds CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-28325 SolarWinds Observability Self-Hosted RCE via Deserializationwrite-up | [ HIGH ] | 8.8 | 1.5% | — |
| CVE-2026-28324 SolarWinds Observability Self-Hosted Unauth RCEwrite-up | [ CRITICAL ] | 9.8 | 0.7% | — |
| CVE-2026-28326 SolarWinds ARM hard-coded key enables unauthenticated RCEwrite-up | [ HIGH ] | 8.8 | 0.7% | — |
Not on CISA KEV as of our last sync. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org.
Machine-readable: /api/v1/vendors/solarwinds.json.
Every CVE row links to its record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker, the vendor scorecard, or all vendors.