SolarWinds

Records350All Threatist records

Exploited (KEV)11In CISA KEV

CVSS critical82CVSS 9.0–10.0

CVSS high139CVSS 7.0–8.9

Exploited now

SolarWinds records in CISA KEV

TI-2026-22619 SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability CRITICAL 90KEV 2026-06-05 TI-2025-19358 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability CRITICAL 100KEV 2026-03-09 TI-2025-27034 SolarWinds Web Help Desk Security Control Bypass Vulnerability CRITICAL 100KEV 2026-02-12 TI-2025-27044 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability CRITICAL 100KEV 2026-02-03 TI-2024-19176 SolarWinds Web Help Desk Hardcoded Credential Vulnerability CRITICAL 98KEV 2024-10-15 TI-2024-19175 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability CRITICAL 100KEV 2024-08-15

Components

Products in the NVD configurations · select one to filter the records

Serv-u 55 records CRITICAL Orion Platform 49 records CRITICAL Access Rights Manager 32 records HIGH Solarwinds Platform 27 records MEDIUM Web Help Desk 22 records CRITICAL Serv-u File Server 20 records HIGH Serv-u Ftp Server 11 records HIGH Database Performance Analyzer 10 records MEDIUM

Records

8 records in Observability Self-hosted · all components

TI-2026-22601 CVE-2026-28297 · GHSA-p9wr-gf3w-34v9

SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability

MEDIUM 40

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.

CVSS 3.1HIGH 8.7 Adjacent network Low privileges No interaction EPSS 0.00386 Published 2026-03-26 No fix listed CWE-79

TI-2026-22602 CVE-2026-28298 · GHSA-c2f7-jh9g-224w

SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability

LOW 37

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.

CVSS 3.1HIGH 8.1 Adjacent network Low privileges User interaction EPSS 0.00359 Published 2026-03-26 No fix listed CWE-79

TI-2025-19356 CVE-2025-26397 · GHSA-4jq7-688w-w4r4

SolarWinds Observability Self-Hosted Deserialization of Untrusted Data Local Privilege Escalation Vulnerability

LOW 36

SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00345 Published 2025-07-24 No fix listed CWE-502

TI-2025-19354 CVE-2025-26395 · GHSA-5r93-p7fh-7rjj

SolarWinds SWOSH DOM-based reflective XSS Vulnerability

LOW 31

SolarWinds Observability Self-Hosted was susceptible to a cross-site scripting (XSS) vulnerability due to an unsanitized field in the URL.

CVSS 3.1HIGH 7.1 Adjacent network High privileges User interaction EPSS 0.00216 Published 2025-06-10 No fix listed CWE-79

TI-2025-19351 CVE-2025-26392 · GHSA-9m5c-jx79-qw78

SolarWinds Observability Self-Hosted SQL Injection Vulnerability

LOW 24

SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account.

CVSS 3.1MEDIUM 5.4 Adjacent network Low privileges No interaction EPSS 0.00237 Published 2025-10-21 No fix listed CWE-89

TI-2025-19350 CVE-2025-26391 · GHSA-rmmr-w34p-g372

Cross-site scripting in SolarWinds Observability Self-Hosted

LOW 24

SolarWinds Observability Self-Hosted XSS Vulnerability.

CVSS 3.1MEDIUM 5.4 Adjacent network Low privileges No interaction EPSS 0.00314 Published 2025-11-18 No fix listed CWE-79

TI-2025-27040 CVE-2025-40545 · GHSA-78p5-9w95-jc9j

SolarWinds Observability Self-Hosted Open Redirection Vulnerability

LOW 22

SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability.

CVSS 3.1MEDIUM 4.8 Adjacent network Low privileges No interaction EPSS 0.0026 Published 2025-11-18 No fix listed CWE-601

TI-2025-19353 CVE-2025-26394 · GHSA-jh26-j8cj-qf46

SolarWinds SWOSH Open Redirection Vulnerability

LOW 21

SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability.

CVSS 3.1MEDIUM 4.8 Adjacent network Low privileges No interaction EPSS 0.00199 Published 2025-06-10 No fix listed CWE-601

Open these records in search →