SolarWinds has 12 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 7 in the last 90 days against 1 in the 90 before. The busiest recent month was October 2026 with 4. The median CVSS is 8.8 (high), with 4 rated critical. 25% have been exploited in the wild — well above the 1% corpus average, so SolarWinds flaws are worth patching on sight. When CISA adds a SolarWinds CVE to KEV it happens fast: a median of 6 days after publication (3 cases). The most common weakness class is CWE-502 (3). Most affected products: SolarWinds Observability Self-Hosted (3), Observability Self-Hosted (2), Serv-U (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 25% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- 6 d median(3)
- Last 90 days
- 7 prev 1
Products
- SolarWinds Observability Self-Hosted 3
- Observability Self-Hosted 2
- Serv-U 2
- Access Rights Manager 1
- Patch Manager 1
- Web Help Desk 1
Worst active — by depth score
CVE-2025-26399Critical· 9.8SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine100CVE-2025-40551Critical· 9.8SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability96CVE-2026-28318High· 7.5SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability75CVE-2026-28326High· 8.8SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability61CVE-2026-28324Critical· 9.8SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks54
SolarWinds vulnerabilities
CVEs affecting SolarWinds, newest first. Open any entry for full detail, references, and exploit status.
12 CVEsRSS
CVE-2026-28328High· 8.8SolarWinds Observability Self-Hosted broken authorization schema
SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.
CVE-2026-28330Medium· 4.6SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability
SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the brows…
CVE-2026-28329Medium· 6.4SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF)
SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal d…
CVE-2026-28331Medium· 4.4SolarWinds Patch Manager Sensitive Information Exposure Vulnerability
SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges.
CVE-2026-28325High· 8.8SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode.
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode.
CVE-2026-28324Critical· 9.8SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are …
CVE-2026-28326High· 8.8PoCSolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability
SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.
CVE-2026-28318High· 7.5CISA KEV0dayPoCSolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Tru…
CVE-2025-40551Critical· 9.8CISA KEVPoCSolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited …
CVE-2025-40548Critical· 9.1A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code
A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the ri…
CVE-2025-26392Medium· 5.4SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account
SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerability requires authentication from a low-privilege account.
CVE-2025-26399Critical· 9.8CISA KEVPoCSolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability …