Vendor
SolarWinds vulnerabilities
190 advisories tracked, 11 exploited in the wild according to CISA, 34 published in 2026.
Data refreshed 13 Oct 2026
Patch now
Exploited in the last two years (CISA KEV), or a 10%+ chance of exploitation in the next 30 days (EPSS).
CVE-2026-28318Serv-U
SolarWinds Serv-U Unauthenticated Denial of Service VulnerabilityCVE-2025-26399Web Help Desk
SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation VulnerabilityCVE-2025-40536Web Help Desk
SolarWinds Web Help Desk Security Control Bypass VulnerabilityCVE-2025-40551Web Help Desk
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution VulnerabilityCVE-2025-40554Web Help Desk
SolarWinds Web Help Desk Authentication Bypass VulnerabilityCVE-2025-40553Web Help Desk
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
Show all 33Show fewer
CVE-2025-40552Web Help Desk
SolarWinds Web Help Desk Authentication Bypass VulnerabilityCVE-2024-28988Web Help Desk
SolarWinds Web Help Desk Java Deserialization Remote Code Execution VulnerabilityCVE-2024-28987Web Help Desk
SolarWinds Web Help Desk Hardcoded Credential VulnerabilityCVE-2024-28074Access Rights Manager
SolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution VulnerabilityCVE-2024-23469Access Rights Manager
SolarWinds Access Rights Manager Exposed Dangerous Method Remote Code Execution VulnerabilityCVE-2024-23472Access Rights Manager
SolarWinds Access Rights Manager Directory Traversal Arbitrary File Deletion and Information Disclosure VulnerabilityCVE-2024-28999SolarWinds Platform (Orion)
SolarWinds Platform Race Condition VulnerabilityCVE-2024-28075Access Rights Manager
SolarWinds ARM Deserialization of Untrusted Data Remote Code ExecutionCVE-2024-0692Security Event Manager
SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution VulnerabilityCVE-2024-23478Access Rights Manager
SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code ExecutionCVE-2023-35180Access Rights Manager
SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution VulnerabilityCVE-2022-38111SolarWinds Platform (Orion)
SolarWinds Platform Deserialization of Untrusted Data VulnerabilityCVE-2022-47503SolarWinds Platform (Orion)
SolarWinds Platform Deserialization of Untrusted Data VulnerabilityCVE-2022-47504SolarWinds Platform (Orion)
SolarWinds Platform Deserialization of Untrusted Data VulnerabilityCVE-2023-23836SolarWinds Platform (Orion)
SolarWinds Platform Deserialization of Untrusted Data VulnerabilityCVE-2022-36964SolarWinds Platform (Orion)
SolarWinds Platform Deserialization of Untrusted DataCVE-2022-36957SolarWinds Platform (Orion)
SolarWinds Platform Deserialization of Untrusted DataCVE-2022-36958SolarWinds Platform (Orion)
SolarWinds Platform Deserialization of Untrusted DataCVE-2022-38108SolarWinds Platform (Orion)
SolarWinds Platform Deserialization of Untrusted DataCVE-2022-36961SolarWinds Platform (Orion)
Orion Platform SQL Injection Privilege Escalation VulnerabilityCVE-2021-35250Serv-U
Directory Transversal Vulnerability in Serv-U 15.3CVE-2021-35217SolarWinds Platform (Orion)
Insecure Deserialization of untrusted data causing Remote code execution vulnerability.CVE-2021-35218SolarWinds Platform (Orion)
Chart Endpoint Deserialization of Untrusted Data Remote Code Execution VulnerabilityCVE-2021-35216SolarWinds Platform (Orion)
Deserialization of Untrusted Data in Resource Controls Remote Code ExecutionCVE-2021-35215SolarWinds Platform (Orion)
ActionPluginBaseView Deserialization of Untrusted Data RCECVE-2021-31474SolarWinds Platform (Orion)
This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWind…CVE-2020-27871SolarWinds Platform (Orion)
This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWind…
Products covered
Select a product to see only its advisories.
- SolarWinds Platform (Orion)Observability Self-Hosted and the Orion modules91 tracked
- Serv-UThe managed file transfer server42 tracked
- Web Help DeskThe IT help desk server20 tracked
- Access Rights ManagerActive Directory permissions and access auditing33 tracked
- Security Event ManagerThe SIEM appliance4 tracked
All tracked advisories
Newest first. Full analysis marks the CVEs we've written up in depth; the rest link to an automatic summary.
| Published | CVE | Product | Issue | Severity | EPSS | Exploited |
|---|---|---|---|---|---|---|
| CVE-2026-28325 | SolarWinds Platform (Orion) | SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability | HIGH 8.8 | 1.5% | – | |
| CVE-2026-28324 | SolarWinds Platform (Orion) | SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability | CRITICAL 9.8 | 0.65% | – | |
| CVE-2026-28326 | Access Rights Manager | SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability | HIGH 8.8 | 0.69% | – | |
| CVE-2026-28323 | Web Help Desk | SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability | CRITICAL 9.8 | 1.0% | – | |
| CVE-2026-28321 | Serv-U | SolarWinds Serv-U Broken Access Control Vulnerability | CRITICAL 9.1 | 0.58% | – | |
| CVE-2026-28317 | Serv-U | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | CRITICAL 9.1 | 0.50% | – | |
| CVE-2026-28316 | Serv-U | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | CRITICAL 9.1 | 2.1% | – | |
| CVE-2026-28315 | Serv-U | SolarWinds Serv-U Authenticated Stored Cross-site Scripting (XSS) Vulnerability | MEDIUM 6.2 | 0.52% | – | |
| CVE-2026-28314 | Serv-U | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | CRITICAL 9.1 | 0.62% | – | |
| CVE-2026-28313 | Serv-U | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | CRITICAL 9.1 | 0.50% | – | |
| CVE-2026-28312 | Serv-U | SolarWinds Serv-U Privilege Escalation Vulnerability | CRITICAL 9.1 | 0.58% | – | |
| CVE-2026-28310 | Serv-U | SolarWinds Serv-U Privilege Escalation Vulnerability | CRITICAL 9.1 | 0.50% | – | |
| CVE-2026-28309 | Serv-U | SolarWinds Serv-U Broken Access Control Vulnerability | CRITICAL 9.1 | 0.50% | – | |
| CVE-2026-28308 | Serv-U | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | CRITICAL 9.1 | 0.79% | – | |
| CVE-2026-28307 | Serv-U | SolarWinds Serv-U Privilege Escalation Vulnerability | CRITICAL 9.1 | 0.50% | – | |
| CVE-2026-28306 | Serv-U | SolarWinds Serv-U Privilege Escalation Vulnerability | CRITICAL 9.1 | 0.50% | – | |
| CVE-2026-28305 | Serv-U | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | CRITICAL 9.1 | 0.79% | – | |
| CVE-2026-28304 | Serv-U | SolarWinds Serv-U Remote Code Execution Vulnerability | CRITICAL 9.1 | 0.79% | – | |
| CVE-2026-28302 | Serv-U | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | CRITICAL 9.1 | 0.79% | – | |
| CVE-2026-28301 | SolarWinds Platform (Orion) | SolarWinds Observability Self-Hosted Open Redirect Vulnerability | MEDIUM 4.8 | 0.36% | – | |
| CVE-2026-28318Full analysis | Serv-U | SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability | HIGH 7.5 | 1.9% | Yes | |
| CVE-2026-28299 | Web Help Desk | SolarWinds Web Help Desk Denial-of-Service Vulnerability | HIGH 8.2 | 0.71% | – | |
| CVE-2026-28298 | SolarWinds Platform (Orion) | SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability | MEDIUM 5.9 | 0.42% | – | |
| CVE-2026-28297 | SolarWinds Platform (Orion) | SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability | MEDIUM 6.1 | 0.45% | – | |
| CVE-2025-40540 | Serv-U | SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability | CRITICAL 9.1 | 0.46% | – | |
| CVE-2025-40539 | Serv-U | SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability | CRITICAL 9.1 | 0.46% | – | |
| CVE-2025-40538 | Serv-U | SolarWinds Serv-U Broken Access Control Remote Code Execution Vulnerability | CRITICAL 9.1 | 0.52% | – | |
| CVE-2025-40541 | Serv-U | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Remote Code Execution Vulnerability | CRITICAL 9.1 | 0.59% | – | |
| CVE-2025-40554 | Web Help Desk | SolarWinds Web Help Desk Authentication Bypass Vulnerability | CRITICAL 9.8 | 61% | – | |
| CVE-2025-40553 | Web Help Desk | SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability | CRITICAL 9.8 | 68% | – | |
| CVE-2025-40552 | Web Help Desk | SolarWinds Web Help Desk Authentication Bypass Vulnerability | CRITICAL 9.8 | 52% | – | |
| CVE-2025-40551Full analysis | Web Help Desk | SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability | CRITICAL 9.8 | 84% | Yes | |
| CVE-2025-40537 | Web Help Desk | SolarWinds Web Help Desk Hardcoded Credentials Vulnerability | HIGH 7.5 | 0.59% | – | |
| CVE-2025-40536Full analysis | Web Help Desk | SolarWinds Web Help Desk Security Control Bypass Vulnerability | HIGH 8.1 | 74% | Yes | |
| CVE-2025-26391 | SolarWinds Platform (Orion) | SolarWinds Observability Self-Hosted XSS Vulnerability | MEDIUM 5.4 | 0.28% | – | |
| CVE-2025-40545 | SolarWinds Platform (Orion) | SolarWinds Observability Self-Hosted Open Redirection Vulnerability | MEDIUM 4.8 | 0.23% | – | |
| CVE-2025-40549 | Serv-U | SolarWinds Serv-U Path Restriction Bypass Vulnerability | CRITICAL 9.1 | 1.1% | – | |
| CVE-2025-40548 | Serv-U | SolarWinds Serv-U Broken Access Control - Remote Code Execution Vulnerability | CRITICAL 9.1 | 0.70% | – | |
| CVE-2025-40547 | Serv-U | SolarWinds Serv-U Logic Abuse - Remote Code Execution Vulnerability | CRITICAL 9.1 | 0.89% | – | |
| CVE-2025-26392 | SolarWinds Platform (Orion) | SolarWinds Observability Self-Hosted SQL Injection Vulnerability | MEDIUM 5.4 | 0.24% | – | |
| CVE-2025-26399 | Web Help Desk | SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability | CRITICAL 9.8 | 90% | Yes · ransomware | |
| CVE-2024-28988 | Web Help Desk | SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability | CRITICAL 9.8 | 39% | – | |
| CVE-2025-26400 | Web Help Desk | SolarWinds Web Help Desk XML External Entity Injection (XXE) Vulnerability | MEDIUM 5.3 | 0.28% | – | |
| CVE-2025-26397 | SolarWinds Platform (Orion) | SolarWinds Observability Self-Hosted Deserialization of Untrusted Data Local Privilege Escalation Vulnerability | HIGH 7.8 | 0.29% | – | |
| CVE-2025-26395 | SolarWinds Platform (Orion) | SolarWinds SWOSH DOM-based reflective XSS Vulnerability | HIGH 7.1 | 0.21% | – | |
| CVE-2025-26394 | SolarWinds Platform (Orion) | SolarWinds SWOSH Open Redirection Vulnerability | MEDIUM 4.8 | 0.19% | – | |
| CVE-2024-45712 | Serv-U | SolarWinds Serv-U Client-Side Cross-Site Scripting Vulnerability | LOW 2.6 | 0.38% | – | |
| CVE-2024-52611 | SolarWinds Platform (Orion) | SolarWinds Platform Information Disclosure Vulnerability | LOW 3.5 | 0.35% | – | |
| CVE-2024-52612 | SolarWinds Platform (Orion) | SolarWinds Platform Reflected Cross-Site Scripting Vulnerability | MEDIUM 6.8 | 0.54% | – | |
| CVE-2024-28989 | Web Help Desk | SolarWinds Web Help Desk Cryptographic Key Management Vulnerability | MEDIUM 5.5 | 0.29% | – | |
| CVE-2024-45709 | Web Help Desk | SolarWinds Web Help Desk Local File Read Vulnerability | MEDIUM 5.3 | 0.50% | – | |
| CVE-2024-45717 | SolarWinds Platform (Orion) | SolarWinds Platform Cross- Site Scripting Vulnerability | HIGH 7 | 0.38% | – | |
| CVE-2024-45711 | Serv-U | SolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution Vulnerability | HIGH 7.5 | 6.3% | – | |
| CVE-2024-45714 | Serv-U | SolarWinds Serv-U Stored XSS Vulnerability | MEDIUM 4.8 | 0.89% | – | |
| CVE-2024-45715 | SolarWinds Platform (Orion) | SolarWinds Platform Edit Function Cross-Site Scripting Vulnerability | HIGH 7.1 | 0.34% | – | |
| CVE-2024-45710 | SolarWinds Platform (Orion) | SolarWinds Platform Uncontrolled Search Path Element Local Privilege Escalation Vulnerability | HIGH 7.8 | 0.28% | – | |
| CVE-2024-28991 | Access Rights Manager | SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution | CRITICAL 9 | 3.1% | – | |
| CVE-2024-28990 | Access Rights Manager | SolarWinds Access Rights Manager (ARM) Hardcoded Credentials Authentication Bypass Vulnerability | MEDIUM 6.3 | 0.47% | – | |
| CVE-2024-28987 | Web Help Desk | SolarWinds Web Help Desk Hardcoded Credential Vulnerability | CRITICAL 9.1 | 93% | Yes | |
| CVE-2024-28986 | Web Help Desk | SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability | CRITICAL 9.8 | 85% | Yes | |
| CVE-2024-23471 | Access Rights Manager | SolarWinds Access Rights Manager (ARM) CreateFile Directory Traversal Remote Code Execution Vulnerability | CRITICAL 9.6 | 1.3% | – | |
| CVE-2024-23470 | Access Rights Manager | SolarWinds Access Rights Manager (ARM) UserScriptHumster Exposed Dangerous Method Remote Command Execution Vulnerability | CRITICAL 9.6 | 1.2% | – | |
| CVE-2024-28074 | Access Rights Manager | SolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability | CRITICAL 9.6 | 11% | – | |
| CVE-2024-23467 | Access Rights Manager | SolarWinds Access Rights Manager Directory Traversal Remote Code Execution Vulnerability | CRITICAL 9.6 | 2.9% | – | |
| CVE-2024-23466 | Access Rights Manager | SolarWinds Access Rights Manager Directory Traversal Remote Code Execution Vulnerability | CRITICAL 9.6 | 2.5% | – | |
| CVE-2024-23465 | Access Rights Manager | SolarWinds Access Rights Manager (ARM) ChangeHumster Exposed Dangerous Method Authentication Bypass Vulnerability | HIGH 8.3 | 1.9% | – | |
| CVE-2024-23469 | Access Rights Manager | SolarWinds Access Rights Manager Exposed Dangerous Method Remote Code Execution Vulnerability | CRITICAL 9.6 | 18% | – | |
| CVE-2024-23475 | Access Rights Manager | SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability | CRITICAL 9.6 | 2.1% | – | |
| CVE-2024-23472 | Access Rights Manager | SolarWinds Access Rights Manager Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability | CRITICAL 9.6 | 19% | – | |
| CVE-2024-28993 | Access Rights Manager | SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability | HIGH 7.6 | 0.95% | – | |
| CVE-2024-28992 | Access Rights Manager | SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability | HIGH 7.6 | 1.9% | – | |
| CVE-2024-23468 | Access Rights Manager | SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability | HIGH 7.6 | 3.4% | – | |
| CVE-2024-23474 | Access Rights Manager | SolarWinds Access Rights Manager (ARM) deleteTransferFile Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability | HIGH 7.6 | 1.5% | – | |
| CVE-2024-28995 | Serv-U | SolarWinds Serv-U L Directory Transversal Vulnerability | HIGH 8.6 | 100% | Yes | |
| CVE-2024-29004 | SolarWinds Platform (Orion) | SolarWinds Platform Stored XSS Vulnerability | HIGH 7.1 | 0.32% | – | |
| CVE-2024-28999 | SolarWinds Platform (Orion) | SolarWinds Platform Race Condition Vulnerability | MEDIUM 6.4 | 14% | – | |
| CVE-2024-28996 | SolarWinds Platform (Orion) | SolarWinds Platform SWQL Injection Vulnerability | HIGH 7.5 | 0.35% | – | |
| CVE-2024-29000 | SolarWinds Platform (Orion) | SolarWinds Platform Reflected XSS Vulnerability | HIGH 7.9 | 0.46% | – | |
| CVE-2024-28075 | Access Rights Manager | SolarWinds ARM Deserialization of Untrusted Data Remote Code Execution | CRITICAL 9 | 78% | – | |
| CVE-2024-23473 | Access Rights Manager | SolarWinds Access Rights Manager (ARM) Hard-Coded Credentials Authentication Bypass Vulnerability | HIGH 8.6 | 1.1% | – | |
| CVE-2024-28072 | Serv-U | Arbitrary File Overwrite Vulnerability | MEDIUM 5.7 | 0.64% | – | |
| CVE-2024-29003 | SolarWinds Platform (Orion) | SolarWinds Platform Cross Site Scripting Vulnerability | HIGH 7.5 | 0.70% | – | |
| CVE-2024-29001 | SolarWinds Platform (Orion) | SolarWinds Platform SWQL Injection Vulnerability | HIGH 7.5 | 0.59% | – | |
| CVE-2024-28076 | SolarWinds Platform (Orion) | SolarWinds Platform Arbitrary Open Redirection Vulnerability | HIGH 7 | 0.34% | – | |
| CVE-2024-28073 | Serv-U | SolarWinds Serv-U Directory Traversal Remote Code Execution Vulnerability | HIGH 8.4 | 1.1% | – | |
| CVE-2024-0692 | Security Event Manager | SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH 8.8 | 92% | – | |
| CVE-2023-40057 | Access Rights Manager | SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution | CRITICAL 9 | 4.9% | – | |
| CVE-2024-23477 | Access Rights Manager | SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability | HIGH 7.9 | 7.8% | – | |
| CVE-2024-23476 | Access Rights Manager | SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability | CRITICAL 9.6 | 7.1% | – | |
| CVE-2024-23478 | Access Rights Manager | SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution | HIGH 8 | 82% | – | |
| CVE-2024-23479 | Access Rights Manager | SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability | CRITICAL 9.6 | 5.8% | – | |
| CVE-2023-35188 | SolarWinds Platform (Orion) | SQL Injection Remote Code Execution Vulnerability | HIGH 8 | 1.5% | – | |
| CVE-2023-50395 | SolarWinds Platform (Orion) | SQL Injection Remote Code Execution Vulnerability | HIGH 8 | 1.6% | – | |
| CVE-2023-40058 | Access Rights Manager | Sensitive Information Disclosure Vulnerability | MEDIUM 6.5 | 0.80% | – | |
| CVE-2023-40053 | Serv-U | HTML injection Vulnerability in Serv-U 15.4 | MEDIUM 5 | 0.83% | – | |
| CVE-2023-40056 | SolarWinds Platform (Orion) | SolarWinds Platform SQL Injection Remote Code Execution Vulnerability | HIGH 8 | 4.8% | – | |
| CVE-2023-40055 | SolarWinds Platform (Orion) | SolarWinds Network Configuration Manager Directory Traversal Remote Code Execution Vulnerability | HIGH 8 | 2.1% | – | |
| CVE-2023-40054 | SolarWinds Platform (Orion) | SolarWinds Network Configuration Manager Directory Traversal Remote Code Execution Vulnerability | HIGH 8 | 3.0% | – | |
| CVE-2023-33227 | SolarWinds Platform (Orion) | Directory Traversal Remote Code Execution Vulnerability | HIGH 8 | 1.8% | – | |
| CVE-2023-33226 | SolarWinds Platform (Orion) | Directory Traversal Remote Code Execution Vulnerability | HIGH 8 | 1.8% | – | |
| CVE-2023-40061 | SolarWinds Platform (Orion) | Insecure Job Execution Mechanism Vulnerability | HIGH 8.8 | 0.42% | – | |
| CVE-2023-40062 | SolarWinds Platform (Orion) | Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability | HIGH 8 | 2.7% | – | |
| CVE-2023-35180 | Access Rights Manager | SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH 8 | 27% | – | |
| CVE-2023-35181 | Access Rights Manager | SolarWinds Access Rights Manager Incorrect Default Permissions Local Privilege Escalation Vulnerability | HIGH 7.8 | 0.18% | – | |
| CVE-2023-35182 | Access Rights Manager | SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH 8.8 | 2.4% | – | |
| CVE-2023-35183 | Access Rights Manager | SolarWinds Access Rights Manager Incorrect Default Permissions Local Privilege Escalation Vulnerability | HIGH 7.8 | 0.20% | – | |
| CVE-2023-35184 | Access Rights Manager | SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH 8.8 | 1.4% | – | |
| CVE-2023-35185 | Access Rights Manager | SolarWinds Access Rights Manager OpenFile Directory Traversal Remote Code Execution Vulnerability | MEDIUM 6.8 | 1.1% | – | |
| CVE-2023-35186 | Access Rights Manager | SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH 8 | 2.2% | – | |
| CVE-2023-35187 | Access Rights Manager | SolarWinds Access Rights Manager Directory Traversal Remote Code Execution Vulnerability | HIGH 8.8 | 3.0% | – | |
| CVE-2023-40060 | Serv-U | 2FA/MFA Bypass Vulnerability in Serv-U 15.4 and 15.4 Hotfix 1 | HIGH 7.2 | 1.0% | – | |
| CVE-2023-35179 | Serv-U | 2FA/MFA Bypass Vulnerability in Serv-U 15.4 | HIGH 7.2 | 1.1% | – | |
| CVE-2023-23843 | SolarWinds Platform (Orion) | SolarWinds Platform Incorrect Comparison Vulnerability | HIGH 7.2 | 2.6% | – | |
| CVE-2023-23844 | SolarWinds Platform (Orion) | SolarWinds Platform Incomplete List of Disallowed Inputs Vulnerability | HIGH 7.2 | 3.0% | – | |
| CVE-2023-33224 | SolarWinds Platform (Orion) | SolarWinds Platform Incorrect Behavior Order Vulnerability | HIGH 7.2 | 2.8% | – | |
| CVE-2023-33225 | SolarWinds Platform (Orion) | SolarWinds Platform Deserialization of Untrusted Data Vulnerability | HIGH 7.2 | 3.2% | – | |
| CVE-2023-23842 | SolarWinds Platform (Orion) | SolarWinds Network Configuration Manager Directory Traversal Vulnerability | HIGH 7.2 | 3.2% | – | |
| CVE-2023-33229 | SolarWinds Platform (Orion) | SolarWinds Platform Incorrect Input Neutralization Vulnerability | LOW 3.5 | 0.77% | – | |
| CVE-2023-23840 | SolarWinds Platform (Orion) | SolarWinds Platform Exposed Dangerous Method Vulnerability | MEDIUM 6.8 | 5.4% | – | |
| CVE-2023-23845 | SolarWinds Platform (Orion) | SolarWinds Platform Exposed Dangerous Method Vulnerability | MEDIUM 6.8 | 5.4% | – | |
| CVE-2023-33228 | SolarWinds Platform (Orion) | SolarWinds Network Configuration Manager Sensitive Information Disclosure Vulnerability | MEDIUM 4.5 | 0.44% | – | |
| CVE-2023-3622 | SolarWinds Platform (Orion) | Access Control Bypass Vulnerability in the SolarWinds Platform | MEDIUM 4.3 | 0.75% | – | |
| CVE-2023-23841 | Serv-U | SolarWinds Serv-U Exposure of Sensitive Information Vulnerability | HIGH 7.5 | 0.46% | – | |
| CVE-2022-36963 | SolarWinds Platform (Orion) | SolarWinds Platform Deserialization of Untrusted Data Vulnerability | HIGH 7.2 | 8.2% | – | |
| CVE-2022-47505 | SolarWinds Platform (Orion) | SolarWinds Platform Local Privilege Escalation Vulnerability | HIGH 7.8 | 0.24% | – | |
| CVE-2022-47509 | SolarWinds Platform (Orion) | SolarWinds Platform Incorrect Input Neutralization Vulnerability | MEDIUM 6.1 | 0.51% | – | |
| CVE-2023-23839 | SolarWinds Platform (Orion) | SolarWinds Platform Exposure of Sensitive Information Vulnerability | MEDIUM 6.5 | 1.1% | – | |
| CVE-2022-38111 | SolarWinds Platform (Orion) | SolarWinds Platform Deserialization of Untrusted Data Vulnerability | HIGH 7.2 | 85% | – | |
| CVE-2022-47508 | SolarWinds Platform (Orion) | SAM 2022.4 | HIGH 7.5 | 0.75% | – | |
| CVE-2022-47503 | SolarWinds Platform (Orion) | SolarWinds Platform Deserialization of Untrusted Data Vulnerability | HIGH 7.2 | 24% | – | |
| CVE-2022-47504 | SolarWinds Platform (Orion) | SolarWinds Platform Deserialization of Untrusted Data Vulnerability | HIGH 7.2 | 25% | – | |
| CVE-2022-47506 | SolarWinds Platform (Orion) | SolarWinds Platform Directory Traversal Vulnerability | HIGH 7.8 | 0.63% | – | |
| CVE-2022-47507 | SolarWinds Platform (Orion) | SolarWinds Platform Deserialization of Untrusted Data Vulnerability | HIGH 7.2 | 7.2% | – | |
| CVE-2023-23836 | SolarWinds Platform (Orion) | SolarWinds Platform Deserialization of Untrusted Data Vulnerability | HIGH 7.2 | 80% | – | |
| CVE-2021-35252 | Serv-U | Common Key Vulnerability in Serv-U FTP Server | HIGH 7.5 | 0.54% | – | |
| CVE-2022-38106 | Serv-U | Cross-Site Scripting Vulnerability in Serv-U Web Client | MEDIUM 5.4 | 0.71% | – | |
| CVE-2022-47512 | SolarWinds Platform (Orion) | Sensitive Data Disclosure Vulnerability | MEDIUM 5.5 | 0.25% | – | |
| CVE-2022-38113 | Security Event Manager | Information Disclosure Vulnerability | MEDIUM 5.3 | 0.70% | – | |
| CVE-2022-38114 | Security Event Manager | Client-Side Desync Vulnerability | MEDIUM 6.1 | 0.55% | – | |
| CVE-2022-38115 | Security Event Manager | Insecure Methods Vulnerability | MEDIUM 5.3 | 0.70% | – | |
| CVE-2022-36962 | SolarWinds Platform (Orion) | SolarWinds Platform Command Injection | HIGH 7.2 | 9.2% | – | |
| CVE-2022-36964 | SolarWinds Platform (Orion) | SolarWinds Platform Deserialization of Untrusted Data | HIGH 8.8 | 17% | – | |
| CVE-2022-36960 | SolarWinds Platform (Orion) | SolarWinds Platform Improper Input Validation | HIGH 8.8 | 0.95% | – | |
| CVE-2022-36957 | SolarWinds Platform (Orion) | SolarWinds Platform Deserialization of Untrusted Data | HIGH 7.2 | 13% | – | |
| CVE-2022-36958 | SolarWinds Platform (Orion) | SolarWinds Platform Deserialization of Untrusted Data | HIGH 8.8 | 82% | – | |
| CVE-2022-38108 | SolarWinds Platform (Orion) | SolarWinds Platform Deserialization of Untrusted Data | HIGH 7.2 | 68% | – | |
| CVE-2022-36966 | SolarWinds Platform (Orion) | Insecure Direct Object Reference Vulnerability: Orion Platform 2020.2.6 | MEDIUM 5.4 | 0.45% | – | |
| CVE-2021-35226 | SolarWinds Platform (Orion) | Hashed Credential Exposure Vulnerability | MEDIUM 6.5 | 0.55% | – | |
| CVE-2022-36961 | SolarWinds Platform (Orion) | Orion Platform SQL Injection Privilege Escalation Vulnerability | HIGH 8.8 | 74% | – | |
| CVE-2022-36965 | SolarWinds Platform (Orion) | Orion Platform | MEDIUM 6.1 | 0.76% | – | |
| CVE-2021-35249 | Serv-U | Domain Admin Broken Access Control | MEDIUM 4.3 | 0.74% | – | |
| CVE-2021-35250 | Serv-U | Directory Transversal Vulnerability in Serv-U 15.3 | HIGH 7.5 | 13% | – | |
| CVE-2021-35254 | Web Help Desk | Authenticated Remote Code Execution in WebHelpDesk 12.7.8 | HIGH 8.2 | 1.0% | – | |
| CVE-2021-35251 | Web Help Desk | Sensitive Data Disclosure Vulnerability | MEDIUM 5.3 | 0.95% | – | |
| CVE-2021-35247 | Serv-U | Improper Input Validation Vulnerability in Serv-U | MEDIUM 4.3 | 3.5% | Yes | |
| CVE-2021-35243 | Web Help Desk | HTTP PUT & DELETE Methods Enabled | MEDIUM 5.3 | 0.90% | – | |
| CVE-2021-35232 | Web Help Desk | Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries | MEDIUM 6.8 | 0.30% | – | |
| CVE-2021-35244 | SolarWinds Platform (Orion) | Unrestricted File Upload Causing Remote Code Execution: Orion Platform 2020.2.6 | MEDIUM 6.8 | 6.0% | – | |
| CVE-2021-35234 | SolarWinds Platform (Orion) | Exposed Dangerous Functions - Privileged Escalation | HIGH 8 | 2.9% | – | |
| CVE-2021-35248 | SolarWinds Platform (Orion) | Unrestricted access to Orion.UserSettings SWIS entity for low-privilege users | MEDIUM 6.8 | 0.92% | – | |
| CVE-2021-35242 | Serv-U | A valid CSRF token is present in response to an invalid request | HIGH 8.3 | 0.79% | – | |
| CVE-2021-35245 | Serv-U | Broken Access Control Vulnerability for SolarWinds Serv-U | HIGH 8.4 | 1.2% | – | |
| CVE-2021-35225 | SolarWinds Platform (Orion) | Netpath Horizontal Privilege Escalation Vulnerability: NPM 2020.2.5 | MEDIUM 5 | 0.84% | – | |
| CVE-2021-35227 | Access Rights Manager | Insecure Web Configuration for RabbitMQ Management Plugin in SolarWinds ARM | MEDIUM 4.7 | 0.48% | – | |
| CVE-2021-35217 | SolarWinds Platform (Orion) | Insecure Deserialization of untrusted data causing Remote code execution vulnerability. | HIGH 8.9 | 73% | – | |
| CVE-2021-35218 | SolarWinds Platform (Orion) | Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability | HIGH 8.9 | 76% | – | |
| CVE-2021-35216 | SolarWinds Platform (Orion) | Deserialization of Untrusted Data in Resource Controls Remote Code Execution | HIGH 8.9 | 81% | – | |
| CVE-2021-35238 | SolarWinds Platform (Orion) | Stored XSS through URL POST parameter in CreateExternalWebsite Vulnerability | MEDIUM 4.8 | 1.1% | – | |
| CVE-2021-35213 | SolarWinds Platform (Orion) | Orion User setting Improper Access Control Privilege Escalation Vulnerability | HIGH 8.9 | 3.4% | – | |
| CVE-2021-35212 | SolarWinds Platform (Orion) | Blind SQL injection Vulnerability | HIGH 8.9 | 1.6% | – | |
| CVE-2021-35223 | Serv-U | Execute Command Function Allows Remote Code Execution (RCE)Vulnerability | HIGH 8.5 | 2.9% | – | |
| CVE-2021-35240 | SolarWinds Platform (Orion) | Stored XSS via Help Server settings | MEDIUM 6.5 | 1.1% | – | |
| CVE-2021-35239 | SolarWinds Platform (Orion) | Stored XSS in Maps text box hyperlink Vulnerability | HIGH 7.5 | 1.0% | – | |
| CVE-2021-35222 | SolarWinds Platform (Orion) | Resource.aspx Reflected Cross-Site Scripting Vulnerability | HIGH 8 | 2.6% | – | |
| CVE-2021-35221 | SolarWinds Platform (Orion) | ImportAlert Improper Access Control Tampering Vulnerability | MEDIUM 6.3 | 2.0% | – | |
| CVE-2021-35220 | SolarWinds Platform (Orion) | EmailWebPage Command Injection RCE | HIGH 8.1 | 2.5% | – | |
| CVE-2021-35219 | SolarWinds Platform (Orion) | ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability | MEDIUM 6 | 0.84% | – | |
| CVE-2021-32076 | Web Help Desk | Access Restriction bypass vulnerability via referrer spoof - Business Logic Bypass | MEDIUM 5.3 | 1.2% | – | |
| CVE-2021-35215 | SolarWinds Platform (Orion) | ActionPluginBaseView Deserialization of Untrusted Data RCE | HIGH 8.9 | 70% | – | |
| CVE-2021-35211 | Serv-U | Serv-U Remote Memory Escape Vulnerability | CRITICAL 9 | 91% | Yes · ransomware | |
| CVE-2021-31475 | SolarWinds Platform (Orion) | This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWind… | HIGH 8.8 | 6.5% | – | |
| CVE-2021-31474 | SolarWinds Platform (Orion) | This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWind… | CRITICAL 9.8 | 94% | – | |
| CVE-2021-27277 | SolarWinds Platform (Orion) | This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Or… | HIGH 7.8 | 1.1% | – | |
| CVE-2021-27258 | SolarWinds Platform (Orion) | This vulnerability allows remote attackers to execute escalate privileges on affected installations of Sola… | CRITICAL 9.8 | 4.0% | – | |
| CVE-2021-27240 | SolarWinds Platform (Orion) | This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Pa… | HIGH 7.8 | 0.42% | – | |
| CVE-2020-27869 | SolarWinds Platform (Orion) | This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds N… | HIGH 8.8 | 5.3% | – | |
| CVE-2020-27871 | SolarWinds Platform (Orion) | This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWind… | HIGH 7.2 | 91% | – | |
| CVE-2020-27870 | SolarWinds Platform (Orion) | This vulnerability allows remote attackers to disclose sensitive information on affected installations of S… | HIGH 7.5 | 4.5% | – | |
| CVE-2020-10148 | SolarWinds Platform (Orion) | SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands | CRITICAL 9.8 | 92% | Yes | |
| CVE-2016-3643 | SolarWinds Platform (Orion) | Virtualization Manager Privilege Escalation | HIGH 7.8 | 3.7% | Yes |
Sources: SolarWinds security advisories, CISA KEV and FIRST EPSS. Severity is the vendor's own rating.