Vendor dossier / #27
SolarWinds vulnerabilities in CISA KEV
Answer CISA's KEV catalog lists 11 SolarWinds vulnerabilities as of catalog 2026.09.23, 0.6% of all 1,721 entries and rank 27 of 283 vendors. The first was added on 2021-11-03 and the most recent on 2026-06-05; 2 are flagged as used in ransomware campaigns.
- KEV entries
- 110.6% of catalog
- Last 90 days
- +0added
- Ransomware: known
- 218.2%
- Products
- 4distinct
- First added
- 2021-11-03
- Latest added
- 2026-06-05
- Median days to due
- 14
- Open deadlines
- 0federal
TAdditions per quarter
Table view (by year)
| Year | Added |
|---|---|
| 2021 | 3 |
| 2022 | 1 |
| 2023 | 0 |
| 2024 | 3 |
| 2025 | 0 |
| 2026 | 4 |
QCommon questions
How many SolarWinds vulnerabilities are in CISA KEV?
11, as of KEV catalog 2026.09.23 (released 2026-09-23). That is 0.6% of the catalog.
Which SolarWinds product has the most KEV entries?
Web Help Desk, with 5 entries. 4 products appear in total.
How many SolarWinds KEV vulnerabilities are linked to ransomware?
2 of 11 (18.2%) are flagged by CISA as known to be used in ransomware campaigns.
When was the latest SolarWinds vulnerability added to KEV?
2026-06-05 (CVE-2026-28318).
What is the most common weakness in SolarWinds KEV entries?
CWE-502 (Unsafe deserialization), listed on 3 entries.
PProducts
| Product | Entries | Share of vendor |
|---|---|---|
| Web Help Desk | 5 | 45.5% |
| Serv-U | 4 | 36.4% |
| Orion | 1 | 9.1% |
| Virtualization Manager | 1 | 9.1% |
WWeaknesses
| CWE | Entries | Share of vendor |
|---|---|---|
| CWE-502 Unsafe deserialization | 3 | 27.3% |
| CWE-400 Uncontrolled resource consumption | 1 | 9.1% |
| CWE-693 Protection mechanism failure | 1 | 9.1% |
| CWE-798 Hard-coded credentials | 1 | 9.1% |
| CWE-22 Path traversal | 1 | 9.1% |
| CWE-20 Improper input validation | 1 | 9.1% |
| CWE-787 Out-of-bounds write | 1 | 9.1% |
| CWE-288 Authentication bypass via alternate path | 1 | 9.1% |
| CWE-264 Permissions and access controls (category) | 1 | 9.1% |
EAll 11 entries
| CVE | Product | Vulnerability | Added | Due | Ransomware | CWE |
|---|---|---|---|---|---|---|
| CVE-2026-28318 | Serv-U | SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability | Unknown | CWE-400 | ||
| CVE-2025-26399 | Web Help Desk | SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | Known | CWE-502 | ||
| CVE-2025-40536 | Web Help Desk | SolarWinds Web Help Desk Security Control Bypass Vulnerability | Unknown | CWE-693 | ||
| CVE-2025-40551 | Web Help Desk | SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2024-28987 | Web Help Desk | SolarWinds Web Help Desk Hardcoded Credential Vulnerability | Unknown | CWE-798 | ||
| CVE-2024-28986 | Web Help Desk | SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2024-28995 | Serv-U | SolarWinds Serv-U Path Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2021-35247 | Serv-U | SolarWinds Serv-U Improper Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2021-35211 | Serv-U | SolarWinds Serv-U Remote Code Execution Vulnerability | Known | CWE-787 | ||
| CVE-2020-10148 | Orion | SolarWinds Orion Authentication Bypass Vulnerability | Unknown | CWE-288 | ||
| CVE-2016-3643 | Virtualization Manager | SolarWinds Virtualization Manager Privilege Escalation Vulnerability | Unknown | CWE-264 |
Cite this
CISA's Known Exploited Vulnerabilities catalog lists 11 SolarWinds vulnerabilities (0.6% of all entries). Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/vendors/solarwinds/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23. Vendor names are CISA's vendorProject strings; Telemetry states no facts about SolarWinds beyond this data.