SolarWinds flaws being used in attacks
CISA lists 11 flaws in SolarWinds products as being used in attacks, most recently on 5 Jun 2026. 2 have been used in ransomware.
SolarWindsBeing used in attacks
- On CISA’s list
- 11 flaws, added between 3 Nov 2021 and 5 Jun 2026
- Most recent
- CVE-2026-28318, SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability, added 5 Jun 2026
- Used in ransomware
- 2 flaws, according to CISA
- Products
- Web Help Desk (5), Serv-U (4), Orion (1), Virtualization Manager (1)
What to do
- Update every SolarWinds product you use.Install the updates SolarWinds offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- SolarWinds Serv-U
CVE-2026-28318SolarWinds Serv-U Uncontrolled Resource Consumption VulnerabilitySolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - SolarWinds Web Help Desk
CVE-2025-26399SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilitySolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - SolarWinds Web Help Desk
CVE-2025-40536SolarWinds Web Help Desk Security Control Bypass VulnerabilitySolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - SolarWinds Web Help Desk
CVE-2025-40551SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilitySolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - SolarWinds Web Help Desk
CVE-2024-28987SolarWinds Web Help Desk Hardcoded Credential VulnerabilitySolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - SolarWinds Web Help Desk
CVE-2024-28986SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilitySolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - SolarWinds Serv-U
CVE-2024-28995SolarWinds Serv-U Path Traversal VulnerabilitySolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - SolarWinds Serv-U
CVE-2021-35247SolarWinds Serv-U Improper Input Validation VulnerabilitySolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.CISA’s required actionApply updates per vendor instructions. - SolarWinds Serv-U
CVE-2021-35211SolarWinds Serv-U Remote Code Execution VulnerabilitySolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution.CISA’s required actionApply updates per vendor instructions. - SolarWinds Orion
CVE-2020-10148SolarWinds Orion Authentication Bypass VulnerabilitySolarWinds Orion API contains an authentication bypass vulnerability that could allow a remote attacker to execute API commands.CISA’s required actionApply updates per vendor instructions. - SolarWinds Virtualization Manager
CVE-2016-3643SolarWinds Virtualization Manager Privilege Escalation VulnerabilitySolarWinds Virtualization Manager allows for privilege escalation through leveraging a misconfiguration of sudo.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. SolarWinds on CISA’s site.