38
CVEs
27
Critical
4
High
4
KEV
7
PoC
28
Unpatched C/H
7.9%
Patch Rate
5.7%
Avg EPSS
Severity Breakdown
CRITICAL
27
HIGH
4
MEDIUM
7
LOW
0
Monthly CVE Trend
Affected Products (30)
Serv U
47
Orion Platform
33
Access Rights Manager
31
Solarwinds Platform
25
Web Help Desk
16
N Central
9
Orion Network Performance Monitor
8
Serv U Ftp Server
7
Windows
7
Node.js
7
Dameware Mini Remote Control
6
Network Configuration Manager
6
Database Performance Analyzer
6
Observability Self Hosted
5
Kiwi Syslog Server
5
Log And Event Manager
5
Network Performance Monitor
4
Open Redirect
4
Security Event Manager
4
Orion Web Performance Monitor
4
Patch Manager
3
Log Event Manager
3
Virtualization Manager
3
Java
3
Trend Micro
3
Storage Manager
3
Kiwi Cattools
2
Server And Application Monitor
2
Sftp Scp Server
2
Solarwinds Observability Self Hosted
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-40551 | SolarWinds Web Help Desk contains an unauthenticated Java deserialization vulnerability (CVE-2025-40551, CVSS 9.8) that enables remote code execution. With EPSS 80.6% and KEV listing, this is the more severe of two concurrent WHD vulnerabilities, allowing attackers to execute arbitrary commands on the host server without any credentials. | CRITICAL | 9.8 | 80.6% | 215 |
KEV
PoC
No patch
|
| CVE-2025-40536 | SolarWinds Web Help Desk contains a security control bypass vulnerability (CVE-2025-40536) that allows unauthenticated attackers to access restricted functionality. With EPSS 69% and KEV listing, this CVSS 8.1 vulnerability is particularly concerning given SolarWinds' history of being targeted in supply chain attacks and the sensitive IT service data typically stored in help desk systems. | HIGH | 8.1 | 69.1% | 195 |
KEV
PoC
No patch
|
| CVE-2025-26399 | SolarWinds Web Help Desk contains an unauthenticated deserialization RCE via AjaxProxy, a patch bypass of both CVE-2024-28988 and CVE-2024-28986, the third iteration of this vulnerability. | CRITICAL | 9.8 | 28.2% | 147 |
KEV
PoC
|
| CVE-2026-28318 | Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending specially crafted POST requests using Content-Encoding: deflate. The flaw carries a CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) and maps to CWE-400 (uncontrolled resource consumption), affecting service availability without compromising confidentiality or integrity; no public exploit identified at time of analysis. | HIGH | 7.5 | 0.1% | 108 |
KEV
PoC
No patch
|
| CVE-2025-40552 | SolarWinds Web Help Desk has an authentication bypass vulnerability (EPSS 9.9%) that allows unauthenticated attackers to gain admin access to the helpdesk system. | CRITICAL | 9.8 | 9.9% | 79 |
PoC
No patch
|
| CVE-2025-40554 | SolarWinds Web Help Desk has a second authentication bypass (EPSS 7.8%) providing yet another path to unauthenticated admin access. | CRITICAL | 9.8 | 7.8% | 77 |
PoC
No patch
|
| CVE-2025-40553 | SolarWinds Web Help Desk has a second deserialization vulnerability (EPSS 11.9%) providing another unauthenticated RCE path alongside CVE-2025-40551. | CRITICAL | 9.8 | 11.9% | 61 |
PoC
No patch
|
| CVE-2026-28323 | Authentication bypass in SolarWinds Web Help Desk (WHD) allows remote unauthenticated attackers to circumvent SAML 2.0 single sign-on and gain access to the application when the SAML 2.0 authentication method is enabled. The flaw (CWE-287, Improper Authentication) is rated CVSS 9.8 with full confidentiality, integrity, and availability impact, meaning a successful bypass yields authenticated-level access to help desk data and administrative functions. No public exploit identified at time of analysis and it is not listed in CISA KEV; the high score reflects the pre-authentication network reachability of the SAML endpoint rather than confirmed in-the-wild activity. | CRITICAL | 9.8 | 0.6% | 50 |
No patch
|
| CVE-2026-28316 | Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure direct object reference (IDOR) and elevate to a system administrator, ultimately executing commands as the root user on the underlying host. The flaw affects Serv-U file transfer server deployments, with a reduced impact on Windows installations, and carries a CVSS 9.1 rating driven by a scope change from application admin to OS-level root. There is no public exploit identified at time of analysis and no CISA KEV listing, but SolarWinds self-reported and shipped a fix in the Serv-U 2026-3 release. | CRITICAL | 9.1 | 1.3% | 47 |
No patch
|
| CVE-2026-28302 | Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object reference (IDOR) that lets an authenticated group administrator manipulate object references beyond their authority. The flaw carries a CVSS 9.1 rating because a scope change allows a lower-tier admin to fully compromise the underlying host on Linux/Unix, though impact is reduced on Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the high privilege prerequisite (group admin) is realistic in multi-tenant MFT environments. | CRITICAL | 9.1 | 0.5% | 46 |
No patch
|
| CVE-2026-28304 | Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code remotely, executing as root on Unix/Linux deployments while impact is reduced on Windows. The flaw stems from an access-control weakness (CWE-284) and is corroborated by a vendor 'Authentication Bypass' tag, carrying a CVSS 9.1 (scope-changed) rating. No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than confirmed. | CRITICAL | 9.1 | 0.5% | 46 |
No patch
|
| CVE-2026-28305 | Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct object reference (CWE-639) that an authenticated domain administrator with read/write access to the home directory can abuse to execute code as root on the underlying host. The CVSS 3.1 score of 9.1 reflects a scope change from application-admin context to full OS compromise, with the impact explicitly noted as lower on Windows deployments. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a high-severity but authentication-gated flaw rather than a mass-exploitable unauthenticated bug. | CRITICAL | 9.1 | 0.5% | 46 |
No patch
|
| CVE-2026-28308 | Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct object reference that lets an authenticated domain administrator reference objects outside their intended authorization boundary to run code on the host. The flaw carries a 9.1 CVSS due to network reach, scope change, and full confidentiality/integrity/availability impact, though the practical bar is high because domain administrator access is a prerequisite, and impact is reduced on Windows deployments. No public exploit is identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.1 | 0.5% | 46 |
No patch
|
| CVE-2026-28314 | Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other users' accounts through an insecure direct object reference (CWE-639), where user-controlled identifiers are not properly authorization-checked. Any valid low-effort authenticated session can be leveraged to reach objects belonging to other accounts, with the vendor noting reduced impact on Windows deployments (implying greater exposure on non-Windows/Linux installs). No public exploit has been identified at time of analysis; the issue was reported by SolarWinds and is fixed in the Serv-U 2026-3 release. | CRITICAL | 9.1 | 0.4% | 46 |
No patch
|
| CVE-2026-28312 | Privilege escalation in SolarWinds Serv-U lets an authenticated group member elevate their access to system administrator and execute code as root on Linux/Unix deployments, with reduced impact on Windows. The root cause is improper authorization (CWE-285) reachable over the network; the vendor rates it CVSS 9.1 due to a scope change and full CIA impact, but there is no public exploit identified at time of analysis and it is not in CISA KEV. Fixed in the Serv-U 2026-3 release. | CRITICAL | 9.1 | 0.4% | 46 |
No patch
|