Exploited vulnerabilities (CISA KEV)

CVE-2026-28318 High · 7.5 KEV High · 65 Public exploit CWE-400 Jun 4, 2026

SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update

CVE-2025-40551 Critical · 9.8 KEV Urgent · 79 Public exploit CWE-502 Jan 28, 2026

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

CVE-2025-40536 Critical · 9.8 KEV Urgent · 80 Public exploit CWE-693 Jan 28, 2026

SolarWinds Web Help Desk Security Control Bypass Vulnerability

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.

CVE-2025-26399 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-502 Sep 23, 2025

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.

CVE-2024-28987 Critical · 9.1 KEV Urgent · 83 Public exploit CWE-798 Aug 21, 2024

SolarWinds Web Help Desk Hardcoded Credential Vulnerability

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.

CVE-2024-28986 Critical · 9.8 KEV High · 67 Public exploit CWE-502 Aug 13, 2024

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing. However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.

CVE-2024-28995 High · 7.5 KEV Urgent · 79 Public exploit CWE-22 Jun 6, 2024

SolarWinds Serv-U Path Traversal Vulnerability

SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.

CVE-2021-35247 Medium · 5.3 KEV High · 51 CWE-20 Jan 10, 2022

SolarWinds Serv-U Improper Input Validation Vulnerability

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.

CVE-2021-35211 Critical · 10.0 KEV Urgent · 80 Public exploit Ransomware CWE-787 Jul 14, 2021

SolarWinds Serv-U Remote Code Execution Vulnerability

Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.

CVE-2020-10148 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-306 Dec 29, 2020

SolarWinds Orion Authentication Bypass Vulnerability

The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds Orion Platform versions 2019.4 HF 5, 2020.2 with no hotfix installed, and 2020.2 HF 1 are affected.

CVE-2016-3643 High · 7.8 KEV High · 62 Public exploit CWE-264 Jun 17, 2016

SolarWinds Virtualization Manager Privilege Escalation Vulnerability

SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated by "sudo cat /etc/passwd."