SolarWinds
Number 82 by total vulnerabilities in the catalog.
Computed from the whole catalog when the site is built.
Total vulnerabilities
219
Critical
49
High
97
Known Exploited
11
Exploit available
4
Network, no login needed
20.5%
Of 219 scored records
- Critical
- High
- Medium
- Low
- None or not scored
Show as table
| Period | Total | Critical | High | Medium | Low | None or not scored |
|---|---|---|---|---|---|---|
| 2026 (incomplete) | 42 | 25 | 9 | 8 | 0 | 0 |
| 2025 | 21 | 5 | 3 | 10 | 3 | 0 |
| 2024 | 44 | 15 | 23 | 6 | 0 | 0 |
| 2023 | 45 | 0 | 32 | 12 | 1 | 0 |
| 2022 | 24 | 0 | 10 | 14 | 0 | 0 |
| 2021 | 41 | 3 | 19 | 18 | 1 | 0 |
| 2020 | 1 | 1 | 0 | 0 | 0 | 0 |
| 2019 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2018 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2017 | 0 | 0 | 0 | 0 | 0 | 0 |
| 2016 | 1 | 0 | 1 | 0 | 0 | 0 |
Top products
| Product | Total | Critical/High |
|---|---|---|
| SolarWinds Platform | 41 | 31 |
| Serv-U | 34 | 27 |
| Access Rights Manager | 33 | 29 |
| Web Help Desk | 19 | 12 |
| Orion Platform | 18 | 12 |
| SolarWinds Observability Self-Hosted | 10 | 3 |
| Network Configuration Manager | 7 | 5 |
| Kiwi Syslog Server | 5 | 0 |
| Database Performance Analyzer | 4 | 1 |
| Observability Self-Hosted | 4 | 2 |
Top bug types
| Bug type | Total | Critical/High |
|---|---|---|
| Insecure Deserialization | 32 | 32 |
| Path Traversal | 28 | 24 |
| Cross-Site Scripting | 26 | 8 |
| Improper Access Control | 12 | 9 |
| Improper Input Validation | 10 | 7 |
| Authentication Issues | 9 | 8 |
| SQL Injection | 9 | 8 |
| Insecure Direct Object Reference | 8 | 7 |
| Hard-coded Credentials | 7 | 4 |
| Information Disclosure | 5 | 0 |
Known to be attacked
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-28318 | SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability | High | 48.0% | |
| CVE-2025-40551 | SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability | Critical | 84.2% | |
| CVE-2025-40536 | SolarWinds Web Help Desk Security Control Bypass Vulnerability | High | 73.6% | |
| CVE-2025-26399 | SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability | Critical | 90.6% | |
| CVE-2024-28987 | SolarWinds Web Help Desk Hardcoded Credential Vulnerability | Critical | 93.3% | |
| CVE-2024-28986 | SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability | Critical | 84.6% | |
| CVE-2024-28995 | SolarWinds Serv-U L Directory Transversal Vulnerability | High | 99.6% | |
| CVE-2021-35247 | Improper Input Validation Vulnerability in Serv-U | Medium | 3.6% | |
| CVE-2021-35211 | Serv-U Remote Memory Escape Vulnerability | Critical | 91.2% | |
| CVE-2020-10148 | SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands | Critical | 92.0% |
Newest vulnerabilities
| CVE | Title | Published | Severity | EPSS |
|---|---|---|---|---|
| CVE-2026-28336 | SolarWinds Dameware Command Injection Vulnerability | Critical | 1.6% | |
| CVE-2026-28335 | SolarWinds Dameware Buffer Overflow Vulnerability | High | 1.0% | |
| CVE-2026-28327 | SolarWinds Dameware DLL Hijacking Vulnerability | High | 0.2% | |
| CVE-2026-28331 | SolarWinds Patch Manager Sensitive Information Exposure Vulnerability | Medium | 0.2% | |
| CVE-2026-28330 | SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability | Medium | 0.3% | |
| CVE-2026-28329 | SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF) | Medium | 0.3% | |
| CVE-2026-28328 | SolarWinds Observability Self-Hosted broken authorization schema | High | 0.5% | |
| CVE-2026-28325 | SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability | High | 1.5% | |
| CVE-2026-28324 | SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability | Critical | 0.7% | |
| CVE-2026-28326 | SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability | High | 0.7% |