SolarWinds vendor intelligence

SolarWinds Known Exploited Vulnerabilities

Track evidence-backed exploitation affecting SolarWinds products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.

Browse SolarWinds KEVs Full KEV feed

Total KEVs: 15; Known exploited vulnerabilities affecting SolarWinds products
In CISA KEV: 11; Records also listed in the official catalog
Beyond CISA KEV: 4; Additional exploited vulnerabilities absent from CISA KEV
Sensor Observed: 1; SolarWinds KEV with sensor-observed exploitation activity

The catalog gap matters for SolarWinds exposure

Four of the fifteen exploited SolarWinds vulnerabilities tracked here are not in CISA KEV. Teams relying on the official catalog alone would miss 27% of this vendor portfolio.

73%
Covered by CISA: 27%
Beyond CISA: 7
Product families

Attested SolarWinds vulnerabilities

15 known exploited vulnerabilities in this exploited-vulnerability portfolio. Search, then narrow it to official CISA coverage or the additional records Previdian tracks beyond the catalog.

How exploitation is verified

CVE / description	Product	Confidence	CISA KEV	Added
CVE-2025-40553 SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability	Web Help Desk	Confirmed	Beyond CISA	01 Sep 2026
CVE-2026-28318 SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability	Serv-U	Confirmed	In CISA	05 Jun 2026
CVE-2025-26399 SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability	Web Help Desk	Confirmed	In CISA	01 Jun 2026
CVE-2025-40536 SolarWinds Web Help Desk Security Control Bypass Vulnerability	Web Help Desk	Confirmed	In CISA	01 Jun 2026
CVE-2025-40551 SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability	Web Help Desk	Confirmed	In CISA	01 Jun 2026
CVE-2021-35250 Directory Transversal Vulnerability in Serv-U 15.3	Serv-U	High	Beyond CISA	26 Apr 2025
CVE-2016-3643 SolarWinds Virtualization Manager 6.3.1 and earlier allow local users to gain privileges by leveraging a misconfiguration of sudo, as demonstrated...	Virtualization Manager	Confirmed	In CISA	03 Nov 2021
CVE-2021-35211 Serv-U Remote Memory Escape Vulnerability	Serv-U Managed File Transfer Server and Serv-U Secured FTP	Confirmed	In CISA	03 Nov 2021
CVE-2020-10148 SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands	Orion Platform	Confirmed	In CISA	03 Nov 2021
CVE-2021-35247 Improper Input Validation Vulnerability in Serv-U	Serv-U	Confirmed	In CISA	21 Jan 2022
CVE-2024-28995 SolarWinds Serv-U L Directory Transversal Vulnerability	SolarWinds Serv-U	Confirmed	In CISA	17 Jul 2024
CVE-2024-28986 SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability	Web Help Desk	Confirmed	In CISA	15 Aug 2024
CVE-2024-28987 SolarWinds Web Help Desk Hardcoded Credential Vulnerability	Web Help Desk	Confirmed	In CISA	15 Oct 2024
CVE-2024-0692 SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability	Security Event Manager	High	Beyond CISA	01 Mar 2024
CVE-2021-35232 Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries	Web Help Desk	High	Beyond CISA	27 Dec 2021

Showing 15 of 15 SolarWinds known exploited vulnerabilities.

Recurring weakness patterns

Deserialization, limitation, and use account for nine mapped occurrences across this SolarWinds KEV portfolio.

Browse all KEVs →

CWE-502

Deserialization of Untrusted Data

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-798

Use of Hard-coded Credentials

CWE-306

Missing Authentication for Critical Function

CWE-20

Improper Input Validation

CWE-693

Protection Mechanism Failure

CWE-787

Out-of-bounds Write

CWE-400

Uncontrolled Resource Consumption