SolarWinds

Latest CVEs · RSS

• CVE-2026-28325 2026-09-22 · CVSS 8.8
  SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrust
• CVE-2026-28324 2026-09-22 · CVSS 9.8
  SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks
• CVE-2026-28326 2026-09-17 · CVSS 8.8
  SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static
• CVE-2026-28323 2026-07-30 · CVSS 9.8
  SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled.
• CVE-2026-28321 2026-07-21 · CVSS 9.1
  SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privil
• CVE-2026-28317 2026-07-21 · CVSS 9.1
  SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain admi
• CVE-2026-28316 2026-07-21 · CVSS 9.1
  SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with t
• CVE-2026-28315 2026-07-21 · CVSS 6.2
  SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from an
• CVE-2026-28314 2026-07-21 · CVSS 9.1
  SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impac
• CVE-2026-28313 2026-07-21 · CVSS 9.1
  SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover.
• CVE-2026-28312 2026-07-21 · CVSS 9.1
  SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as r
• CVE-2026-28310 2026-07-21 · CVSS 9.1
  SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system adminis
• CVE-2026-28309 2026-07-21 · CVSS 9.1
  SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is
• CVE-2026-28308 2026-07-21 · CVSS 9.1
  SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is
• CVE-2026-28307 2026-07-21 · CVSS 9.1
  SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is
• CVE-2026-28306 2026-07-21 · CVSS 9.1
  SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator.
• CVE-2026-28305 2026-07-21 · CVSS 9.1
  SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with
• CVE-2026-28304 2026-07-21 · CVSS 9.1
  SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The imp
• CVE-2026-28302 2026-07-21 · CVSS 9.1
  SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as roo
• CVE-2026-28322 2026-06-30 · CVSS 5.6
  SolarWinds Database Performance Analyzer was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended s
• CVE-2026-28301 2026-06-09 · CVSS 4.8
  A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website.
• CVE-2026-28318 2026-06-04 · CVSS 7.5
  SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitiga
• CVE-2026-28299 2026-06-02 · CVSS 8.2
  SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due t
• CVE-2026-28298 2026-03-26 · CVSS 5.9
  SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended scrip
• CVE-2026-28297 2026-03-26 · CVSS 6.1
  SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended scrip