SolarWinds IT Management Software and Remote Monitoring Tools

Known Exploited SolarWinds Vulnerabilities

The following SolarWinds vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Of the known exploited vulnerabilities above, 8 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.

By the Year

In 2026 there have been 32 vulnerabilities in SolarWinds with an average score of 8.4 out of ten. Last year, in 2025 SolarWinds had 14 security vulnerabilities published. That is, 18 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.62.

Recent SolarWinds Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-28321	Jul 21, 2026	SolarWinds Serv-U Broken Access Control (BAC) Enables Arbitrary File RW & Priv Esc SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations.	Serv U
CVE-2026-28317	Jul 21, 2026	SolarWinds Serv-U IDOR Privilege Escalation Vulnerability SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments.	Serv U
CVE-2026-28316	Jul 21, 2026	SolarWinds Serv-U IDOR Priv Escalation via Insecure Direct Object Ref SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in Windows deployments.	Serv U
CVE-2026-28315	Jul 21, 2026	SolarWinds Serv-U Stored XSS: Session Hijack/Info Discl SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from an administrator account.	Serv U
CVE-2026-28314	Jul 21, 2026	SolarWinds ServU IDOR Account Takeover SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower in Windows deployments.	Serv U
CVE-2026-28313	Jul 21, 2026	SolarWinds ServU IDOR Enables SMTP Hijacking & Account Takeover SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.	Serv U
CVE-2026-28312	Jul 21, 2026	SolarWinds Serv-U Privilege Escalation Elevating Group to sysadmin SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a groups access to system administrator and allow code execution as root. The impact is lower in Windows deployments.	Serv U
CVE-2026-28310	Jul 21, 2026	SolarWinds Serv-U PrivEsc: Domain Admin to Sys Admin SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. The impact is lower in Windows deployments.	Serv U
CVE-2026-28309	Jul 21, 2026	SolarWinds Serv-U ACL flaw: domain admin can add sys admin SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments.	Serv U
CVE-2026-28308	Jul 21, 2026	SolarWinds Serv-U IDOR Enables Remote Code Exec SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.	Serv U
CVE-2026-28307	Jul 21, 2026	SolarWinds Serv-U PrivEsc: Domain User -> Admin SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments.	Serv U
CVE-2026-28306	Jul 21, 2026	SolarWinds Serv-U Priv Esc Vulnerability CVE-2026-28306 SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments.	Serv U
CVE-2026-28305	Jul 21, 2026	SolarWinds Serv-U IDOR Enables Root RCE via Insecure Direct Object Reference SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments.	Serv U
CVE-2026-28304	Jul 21, 2026	SolarWinds Serv-U RCE; remote code exec as root (Windows impact lower) SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.	Serv U
CVE-2026-28302	Jul 21, 2026	Serv-U IDOR Enables Priv Escalation & RCE as Root SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.	Serv U
CVE-2026-28322	Jun 30, 2026	SolarWinds DPA Stored XSS Enables Script Execution SolarWinds Database Performance Analyzer was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.	Database Performance Analyzer
CVE-2026-28301	Jun 09, 2026	SolarWinds Orion Open Redirect via Crafted External URL A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website.
CVE-2026-28318	Jun 04, 2026	SolarWinds Serv-U DoS via malformed Content-Encoding: deflate POST SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update	Serv U
CVE-2026-28299	Jun 02, 2026	SolarWinds Web Help Desk DoS via Insufficient Memory Crash SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due to insufficient memory.	Web Help Desk
CVE-2018-25252	Apr 04, 2026	FTP Voyager 16.2.0 DoS via Buffer Overflow in Site Profile IP Field FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by injecting oversized buffer data into the site profile IP field. Attackers can create a malicious site profile containing 500 bytes of repeated characters and paste it into the IP field to trigger a buffer overflow that crashes the FTP Voyager process.	Ftp Voyager
CVE-2026-28298	Mar 26, 2026	SolarWinds Observability Self-Hosted XSS Stored XSS in UI SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.
CVE-2026-28297	Mar 26, 2026	SolarWinds Observability Self-Hosted: Stored XSS Script Exec SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.
CVE-2025-40541	Feb 24, 2026	Serv-U IDOR Enables Privileged Native Code Execution An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as a privileged account. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.	Serv U
CVE-2025-40540	Feb 24, 2026	Serv-U Type Confusion Enables Privileged Native Code Exec A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.	Serv U
CVE-2025-40539	Feb 24, 2026	Serv-U Type Confusion Enables Privileged Native Code Execution A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.	Serv U
CVE-2025-40538	Feb 24, 2026	Serv-U ACL Bypass Privilege Escalation to System Admin A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via domain admin or group admin privileges. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.	Serv U
CVE-2025-40554	Jan 28, 2026	SolarWinds WebHelp Desk Auth Bypass Vulnerability SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.	Web Help Desk
CVE-2025-40553	Jan 28, 2026	SolarWinds Web Help Desk Untrusted Data Deserialization Enables RCE SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.	Web Help Desk
CVE-2025-40552	Jan 28, 2026	SolarWinds Web Help Desk Auth Bypass Vulnerability SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.	Web Help Desk
CVE-2025-40551	Jan 28, 2026	SolarWinds Web Help Desk RCE via Untrusted Deserialization (CVE-2025-40551) SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.	Web Help Desk
CVE-2025-40537	Jan 28, 2026	SolarWinds Web Help Desk Hardcoded Credentials CVE-2025-40537 SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administrative functions.	Web Help Desk
CVE-2025-40536	Jan 28, 2026	SolarWinds WHD Auth Bypass: Unauthenticated R/O Access SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.	Web Help Desk
CVE-2025-40545	Nov 18, 2025	SolarWinds Observability Self-Hosted Open Redirection Vulnerability SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required.
CVE-2025-26391	Nov 18, 2025	SolarWinds Observability Self-Host XSS in URL Fields (Auth Required, Low-Level) SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL fields. This vulnerability requires authentication from a low-level account.
CVE-2025-40549	Nov 18, 2025	Serv-U Path Restriction Bypass Allows Admin Code Exec on Windows A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this scored as medium due to differences in how paths and home directories are handled.	Serv U
CVE-2025-40548	Nov 18, 2025	Admin-Privilege Code Execution via Serv-U (SolarWinds) A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.	Serv U
CVE-2025-40547	Nov 18, 2025	ServU Logic Error Enables Admin Code Exec A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.	Serv U
CVE-2025-26392	Oct 21, 2025	SQLi in SolarWinds Obs. Self-Hosted via lowpriv auth SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerability requires authentication from a low-privilege account.	Observability Self Hosted
CVE-2025-26399	Sep 23, 2025	SolarWinds Web Help Desk AjaxProxy Deserialization RCE (Patch Bypass) SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.	Web Help Desk
CVE-2025-26398	Aug 12, 2025	SolarWinds DPA Hard-Coded Crypto Key – Local Privilege Escalation SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machine-in-the-middle (MITM) attack against users. This vulnerability requires additional software not installed by default, local access to the server and administrator level privileges on the host.	Database Performance Analyzer
CVE-2025-26400	Jul 29, 2025	SolarWinds Web Help Desk XXE Info Disclosure SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files.	Webhelpdesk
CVE-2025-26396	Jun 02, 2025	SolarWinds Dameware Mini RC LPE via Incorrect Permissions The SolarWinds Dameware Mini Remote Control was determined to be affected by Incorrect Permissions Local Privilege Escalation Vulnerability. This vulnerability requires local access and a valid low privilege account to be susceptible to this vulnerability.	Dameware Mini Remote Control
CVE-2024-52606	Feb 11, 2025	CVE-2024-52606: SSRF in SolarWinds Platform via unsanitized input SolarWinds Platform is affected by server-side request forgery vulnerability. Proper input sanitation was not applied allowing for the possibility of a malicious web request.	Solarwinds Platform
CVE-2024-52612	Feb 11, 2025	SolarWinds Orion XSS Authenticated Reflected XSS via Input Param SolarWinds Platform is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters. This vulnerability requires authentication by a high- privileged account to be exploitable.	Solarwinds Platform
CVE-2024-52611	Feb 11, 2025	SolarWinds Platform Info Disclosure via Error Message The SolarWinds Platform is vulnerable to an information disclosure vulnerability through an error message. While the data does not provide anything sensitive, the information could assist an attacker in other malicious actions.	Solarwinds Platform Orion Platform
CVE-2024-28989	Feb 11, 2025	SolarWinds Web Help Desk Hardcoded Crypto Key Allows Sensitive Data Disclosure SolarWinds Web Help Desk was found to have a hardcoded cryptographic key that could allow the disclosure of sensitive information from the software.	Web Help Desk
CVE-2024-45709	Dec 10, 2024	SolarWinds Web Help Desk Local File Read Vulnerability in Development/Test Mode SolarWinds Web Help Desk was susceptible to a local file read vulnerability. This vulnerability requires the software be installed on Linux and configured to use non-default development/test mode making exposure to the vulnerability very limited.	Web Help Desk
CVE-2024-45717	Dec 04, 2024	SolarWinds Platform: Authenticated Stored XSS in Search and Node Information UI The SolarWinds Platform was susceptible to a XSS vulnerability that affects the search and node information section of the user interface. This vulnerability requires authentication and requires user interaction.	Solarwinds Platform
CVE-2024-45713	Oct 17, 2024	SolarWinds Kiwi CatTools Sensitive Data Disclosure via Non-Default Troubleshooting Setting SolarWinds Kiwi CatTools is susceptible to a sensitive data disclosure vulnerability when a non-default setting has been enabled for troubleshooting purposes.	Kiwi Cattools
CVE-2024-45714	Oct 16, 2024	Auth XSS via Variable Modification in unknown web app Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users permissions can modify a variable with a payload.	Serv U