SolarWinds known exploited vulnerabilities

CISA's Known Exploited Vulnerabilities catalog lists 11 SolarWinds vulnerabilities: 4 added in the last 365 days, 6 rated critical (CVSS 9 or higher), and 2 with known ransomware use. The most recent was added Jun 5, 2026.

RSS feed for SolarWinds exploited vulnerabilities · Search them on KEVWire · Ask your AI assistant

Added to KEV	CVE	Vulnerability	CVSS	EPSS	Federal due date	Ransomware use
2026-06-05	CVE-2026-28318	SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability	7.5 (v3.1)	43.7%	2026-06-19	Unknown
2026-03-09	CVE-2025-26399	SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability	9.8 (v3.1)	90.1%	2026-03-12	Known
2026-02-12	CVE-2025-40536	SolarWinds Web Help Desk Security Control Bypass Vulnerability	8.1 (v3.1)	73.6%	2026-02-15	Unknown
2026-02-03	CVE-2025-40551	SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability	9.8 (v3.1)	84.2%	2026-02-06	Unknown
2024-10-15	CVE-2024-28987	SolarWinds Web Help Desk Hardcoded Credential Vulnerability	9.1 (v3.1)	93.3%	2024-11-05	Unknown
2024-08-15	CVE-2024-28986	SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability	9.8 (v3.1)	84.6%	2024-09-05	Unknown
2024-07-17	CVE-2024-28995	SolarWinds Serv-U Path Traversal Vulnerability	8.6 (v3.1)	99.6%	2024-08-07	Unknown
2022-01-21	CVE-2021-35247	SolarWinds Serv-U Improper Input Validation Vulnerability	4.3 (v3.1)	3.5%	2022-02-04	Unknown
2021-11-03	CVE-2016-3643	SolarWinds Virtualization Manager Privilege Escalation Vulnerability	7.8 (v3.1)	3.7%	2022-05-03	Unknown
2021-11-03	CVE-2020-10148	SolarWinds Orion Authentication Bypass Vulnerability	9.8 (v3.1)	92.0%	2022-05-03	Unknown
2021-11-03	CVE-2021-35211	SolarWinds Serv-U Remote Code Execution Vulnerability	9 (v3.1)	91.2%	2021-11-17	Known