Exploited vulnerabilities
SolarWinds
11 SolarWinds vulnerabilities in the CISA KEV catalogue: those for which the US cybersecurity agency has evidence of exploitation in real attacks.
In the catalogue11
Last 12 months4
In ransomware campaigns2
Last addition5 June 2026
The vulnerabilities11
- 5 June 2026CVE-2026-28318Serv-USolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
- 9 March 2026CVE-2025-26399Web Help DeskSolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilityRansomware
- 12 February 2026CVE-2025-40536Web Help DeskSolarWinds Web Help Desk Security Control Bypass Vulnerability
- 3 February 2026CVE-2025-40551Web Help DeskSolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
- 15 October 2024CVE-2024-28987Web Help DeskSolarWinds Web Help Desk Hardcoded Credential Vulnerability
- 15 August 2024CVE-2024-28986Web Help DeskSolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
- 17 July 2024CVE-2024-28995Serv-USolarWinds Serv-U Path Traversal Vulnerability
- 21 January 2022CVE-2021-35247Serv-USolarWinds Serv-U Improper Input Validation Vulnerability
- 3 November 2021CVE-2021-35211Serv-USolarWinds Serv-U Remote Code Execution VulnerabilityRansomware
- 3 November 2021CVE-2020-10148OrionSolarWinds Orion Authentication Bypass Vulnerability
- 3 November 2021CVE-2016-3643Virtualization ManagerSolarWinds Virtualization Manager Privilege Escalation Vulnerability
Data: CISA Known Exploited Vulnerabilities (KEV) catalogue, last addition on 4 November 2026.
The catalogue lists only vulnerabilities with evidence of exploitation, not all of the vendor's vulnerabilities.
Alerts only on the products you use
With My Defence you receive alerts and briefings only on the products you use, SolarWinds included.