17
CVEs
15
Critical
0
High
0
KEV
0
PoC
15
Unpatched C/H
0.0%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
15
HIGH
0
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (30)
Serv U
47
Orion Platform
33
Access Rights Manager
31
Solarwinds Platform
25
Web Help Desk
16
N Central
9
Orion Network Performance Monitor
8
Serv U Ftp Server
7
Windows
7
Node.js
7
Dameware Mini Remote Control
6
Network Configuration Manager
6
Database Performance Analyzer
6
Observability Self Hosted
5
Kiwi Syslog Server
5
Log And Event Manager
5
Network Performance Monitor
4
Open Redirect
4
Security Event Manager
4
Orion Web Performance Monitor
4
Patch Manager
3
Log Event Manager
3
Virtualization Manager
3
Java
3
Trend Micro
3
Storage Manager
3
Kiwi Cattools
2
Server And Application Monitor
2
Sftp Scp Server
2
Solarwinds Observability Self Hosted
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-28323 | Authentication bypass in SolarWinds Web Help Desk (WHD) allows remote unauthenticated attackers to circumvent SAML 2.0 single sign-on and gain access to the application when the SAML 2.0 authentication method is enabled. The flaw (CWE-287, Improper Authentication) is rated CVSS 9.8 with full confidentiality, integrity, and availability impact, meaning a successful bypass yields authenticated-level access to help desk data and administrative functions. No public exploit identified at time of analysis and it is not listed in CISA KEV; the high score reflects the pre-authentication network reachability of the SAML endpoint rather than confirmed in-the-wild activity. | CRITICAL | 9.8 | 0.6% | 50 |
No patch
|
| CVE-2026-28316 | Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure direct object reference (IDOR) and elevate to a system administrator, ultimately executing commands as the root user on the underlying host. The flaw affects Serv-U file transfer server deployments, with a reduced impact on Windows installations, and carries a CVSS 9.1 rating driven by a scope change from application admin to OS-level root. There is no public exploit identified at time of analysis and no CISA KEV listing, but SolarWinds self-reported and shipped a fix in the Serv-U 2026-3 release. | CRITICAL | 9.1 | 1.3% | 47 |
No patch
|
| CVE-2026-28302 | Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object reference (IDOR) that lets an authenticated group administrator manipulate object references beyond their authority. The flaw carries a CVSS 9.1 rating because a scope change allows a lower-tier admin to fully compromise the underlying host on Linux/Unix, though impact is reduced on Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the high privilege prerequisite (group admin) is realistic in multi-tenant MFT environments. | CRITICAL | 9.1 | 0.5% | 46 |
No patch
|
| CVE-2026-28304 | Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code remotely, executing as root on Unix/Linux deployments while impact is reduced on Windows. The flaw stems from an access-control weakness (CWE-284) and is corroborated by a vendor 'Authentication Bypass' tag, carrying a CVSS 9.1 (scope-changed) rating. No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than confirmed. | CRITICAL | 9.1 | 0.5% | 46 |
No patch
|
| CVE-2026-28305 | Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct object reference (CWE-639) that an authenticated domain administrator with read/write access to the home directory can abuse to execute code as root on the underlying host. The CVSS 3.1 score of 9.1 reflects a scope change from application-admin context to full OS compromise, with the impact explicitly noted as lower on Windows deployments. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a high-severity but authentication-gated flaw rather than a mass-exploitable unauthenticated bug. | CRITICAL | 9.1 | 0.5% | 46 |
No patch
|
| CVE-2026-28308 | Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct object reference that lets an authenticated domain administrator reference objects outside their intended authorization boundary to run code on the host. The flaw carries a 9.1 CVSS due to network reach, scope change, and full confidentiality/integrity/availability impact, though the practical bar is high because domain administrator access is a prerequisite, and impact is reduced on Windows deployments. No public exploit is identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.1 | 0.5% | 46 |
No patch
|
| CVE-2026-28314 | Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other users' accounts through an insecure direct object reference (CWE-639), where user-controlled identifiers are not properly authorization-checked. Any valid low-effort authenticated session can be leveraged to reach objects belonging to other accounts, with the vendor noting reduced impact on Windows deployments (implying greater exposure on non-Windows/Linux installs). No public exploit has been identified at time of analysis; the issue was reported by SolarWinds and is fixed in the Serv-U 2026-3 release. | CRITICAL | 9.1 | 0.4% | 46 |
No patch
|
| CVE-2026-28312 | Privilege escalation in SolarWinds Serv-U lets an authenticated group member elevate their access to system administrator and execute code as root on Linux/Unix deployments, with reduced impact on Windows. The root cause is improper authorization (CWE-285) reachable over the network; the vendor rates it CVSS 9.1 due to a scope change and full CIA impact, but there is no public exploit identified at time of analysis and it is not in CISA KEV. Fixed in the Serv-U 2026-3 release. | CRITICAL | 9.1 | 0.4% | 46 |
No patch
|
| CVE-2026-28321 | Privilege escalation to root/code execution in SolarWinds Serv-U (managed/secure file transfer server) arises from a broken access control flaw that grants arbitrary file read and write on the host. An attacker already holding domain administrator access can abuse this to overwrite privileged files and run code as root, with reduced impact on Windows installations. Reported by SolarWinds with no public exploit identified at time of analysis, though the 9.1 CVSS reflects the high confidentiality, integrity, and availability impact once the precondition is met. | CRITICAL | 9.1 | 0.4% | 46 |
No patch
|
| CVE-2026-28306 | Privilege escalation in SolarWinds Serv-U allows a domain administrator to elevate to a full Serv-U system administrator, granting complete control over the managed file transfer server and its data (CVSS 9.1, CWE-284 improper access control). Exploitation requires existing domain-administrator privileges (PR:H) but no user interaction, and the vendor notes the impact is reduced on Windows deployments, implying non-Windows (Linux) installs are more severely affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a defense-in-depth priority rather than a confirmed active threat. | CRITICAL | 9.1 | 0.3% | 46 |
No patch
|
| CVE-2026-28307 | Privilege escalation in SolarWinds Serv-U allows an authenticated member of a domain user group to be elevated into an administrator group, granting full administrative control over the managed file transfer server. The flaw stems from improper access control (CWE-284) and carries a vendor CVSS of 9.1 due to a scope change and full confidentiality, integrity, and availability impact, though SolarWinds notes the impact is lower on Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.1 | 0.3% | 46 |
No patch
|
| CVE-2026-28309 | Privilege escalation in SolarWinds Serv-U managed file transfer allows a user holding domain administrator privileges to create Serv-U system administrator accounts, crossing an authorization boundary the product is expected to enforce independently. Tracked as CVE-2026-28309 (CWE-862, Missing Authorization) and reported by SolarWinds, it carries a 9.1 CVSS due to scope change and full C/I/A impact, though the vendor notes the impact is lower in Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.1 | 0.3% | 46 |
No patch
|
| CVE-2026-28310 | Privilege escalation in SolarWinds Serv-U managed file transfer server allows an existing domain administrator to elevate their Serv-U account from a standard user type to a full system administrator, granting complete control over the file transfer service and its data. The flaw stems from missing authorization (CWE-862) and carries a CVSS 9.1 rating, driven by a scope change and high confidentiality, integrity, and availability impact. SolarWinds notes the impact is lower in Windows deployments, and there is no public exploit identified at time of analysis. | CRITICAL | 9.1 | 0.3% | 46 |
No patch
|
| CVE-2026-28313 | Account takeover in SolarWinds Serv-U is enabled by an insecure direct object reference (IDOR) that lets an authenticated user hijack the SMTP/email flow and seize arbitrary accounts, per SolarWinds' own advisory. Because the flaw crosses a trust boundary (CVSS scope-changed) with high confidentiality, integrity, and availability impact, a single privileged account can be leveraged against other users' accounts; Windows deployments are described by the vendor as lower-impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV. | CRITICAL | 9.1 | 0.3% | 46 |
No patch
|
| CVE-2026-28317 | Privilege escalation in SolarWinds Serv-U file transfer server arises from an insecure direct object reference (IDOR) that lets an actor already holding domain administrator access reference and manipulate objects across an authorization boundary. The flaw is fixed in the Serv-U 2026-3 release and has no public exploit identified at time of analysis; SolarWinds itself reported it. Impact is reduced in Windows deployments, which tempers real-world severity despite the 9.1 CVSS score. | CRITICAL | 9.1 | 0.3% | 46 |
No patch
|