Vendor
SolarWinds
As of , 11 SolarWinds vulnerabilities are on CISA's list of exploited vulnerabilities, 2 of them used in ransomware campaigns; 4 were added in 2026. Patch first: CVE-2025-26399.
Patch first
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 1 | CVE-2025-26399Deserialization of Untrusted Data | SolarWinds Web Help Desk | Patch nowRansomware use, listed within a year | 0.90 | ||
| 2 | CVE-2025-40536Security Control Bypass | SolarWinds Web Help Desk | Patch this weekMetasploit module; EPSS 0.74 | 0.74 | ||
| 3 | CVE-2025-40551Deserialization of Untrusted Data | SolarWinds Web Help Desk | Patch this weekMetasploit module; EPSS 0.84 | 0.84 | ||
| 4 | CVE-2024-28987Hardcoded Credential | SolarWinds Web Help Desk | Patch this weekMetasploit module; EPSS 0.93 | 0.93 | ||
| 5 | CVE-2024-28995Path Traversal | SolarWinds Serv-U | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 6 | CVE-2024-28986Deserialization of Untrusted Data | SolarWinds Web Help Desk | Patch this weekEPSS 0.85 | 0.85 | ||
| 7 | CVE-2020-10148Authentication Bypass | SolarWinds Orion | Patch this weekEPSS 0.92 | 0.92 | ||
| 8 | CVE-2021-35211Remote Code Execution | SolarWinds Serv-U | Patch this weekRansomware use; EPSS 0.91 | 0.91 | ||
| 9 | CVE-2016-3643Privilege Escalation | SolarWinds Virtualization Manager | Patch soon | 0.04 | ||
| 10 | CVE-2021-35247Improper Input Validation | SolarWinds Serv-U | Patch soon | 0.03 | ||
| 11 | CVE-2026-28318Uncontrolled Resource Consumption | SolarWinds Serv-U | Patch soon | 0.02 |
Products
- Web Help Desk5 entries
- Serv-U4 entries
- Orion1 entry
- Virtualization Manager1 entry
Added each year
Show the numbers
| Period | entries added |
|---|---|
| 2021 | 3 |
| 2022 | 1 |
| 2023 | none |
| 2024 | 3 |
| 2025 | none |
| 2026 | 4 |