# Solarwinds vulnerabilities

> Solarwinds has 290 published vulnerabilities across 75 products in our catalogue. 8 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Orion Platform, with 49. If you run Solarwinds software, patch the exploited flaws first.

Canonical page: https://www.edgeprotect.io/vendors/solarwinds

## At a glance

- **Published vulnerabilities:** 290
- **Known to be exploited:** 8
- **Products:** 75
- **Versions:** 556
- **Most recently added to the known-exploited list:** [CVE-2026-28318](https://www.edgeprotect.io/what-is/cve-2026-28318), 5 June 2026. We keep watching the list.

## Which Solarwinds products have the most vulnerabilities?

- [Orion Platform](https://www.edgeprotect.io/product/solarwinds/orion_platform): 49 published vulnerabilities, 20 versions
- [Access Rights Manager](https://www.edgeprotect.io/product/solarwinds/access_rights_manager): 32 published vulnerabilities, 15 versions
- [Serv-U](https://www.edgeprotect.io/product/solarwinds/serv-u): 31 published vulnerabilities, 21 versions
- [Solarwinds Platform](https://www.edgeprotect.io/product/solarwinds/solarwinds_platform): 27 published vulnerabilities, 16 versions
- [Serv-U File Server](https://www.edgeprotect.io/product/solarwinds/serv-u_file_server): 20 published vulnerabilities, 101 versions
- [Web Help Desk](https://www.edgeprotect.io/product/solarwinds/web_help_desk): 11 published vulnerabilities, 28 versions
- [Serv-U FTP Server](https://www.edgeprotect.io/product/solarwinds/serv-u_ftp_server): 11 published vulnerabilities, 12 versions
- [Orion Network Performance Monitor](https://www.edgeprotect.io/product/solarwinds/orion_network_performance_monitor): 9 published vulnerabilities, 22 versions
- [N-Central](https://www.edgeprotect.io/product/solarwinds/n-central): 9 published vulnerabilities, 6 versions
- [Database Performance Analyzer](https://www.edgeprotect.io/product/solarwinds/database_performance_analyzer): 9 published vulnerabilities, 6 versions

Each product page lists its own known-exploited flaws.

## Which Solarwinds vulnerabilities are being exploited?

8 flaws are on the government list of vulnerabilities known to be exploited, newest first:

- [CVE-2026-28318](https://www.edgeprotect.io/what-is/cve-2026-28318): SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability. High, CVSS 7.5, chance of use in 30 days 44%, known exploited since 5 June 2026.
- [CVE-2024-28987](https://www.edgeprotect.io/what-is/cve-2024-28987): SolarWinds Web Help Desk Hardcoded Credential Vulnerability. Critical, CVSS 9.1, chance of use in 30 days 93%, known exploited since 15 October 2024.
- [CVE-2024-28986](https://www.edgeprotect.io/what-is/cve-2024-28986): SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 85%, known exploited since 15 August 2024.
- [CVE-2024-28995](https://www.edgeprotect.io/what-is/cve-2024-28995): SolarWinds Serv-U Path Traversal Vulnerability. High, CVSS 8.6, chance of use in 30 days >99%, known exploited since 17 July 2024.
- [CVE-2021-35247](https://www.edgeprotect.io/what-is/cve-2021-35247): SolarWinds Serv-U Improper Input Validation Vulnerability. Medium, CVSS 4.3, chance of use in 30 days 3.5%, known exploited since 21 January 2022.
- [CVE-2020-10148](https://www.edgeprotect.io/what-is/cve-2020-10148): SolarWinds Orion Authentication Bypass Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 92%, known exploited since 3 November 2021.
- [CVE-2021-35211](https://www.edgeprotect.io/what-is/cve-2021-35211): SolarWinds Serv-U Remote Code Execution Vulnerability. Critical, CVSS 9.0, chance of use in 30 days 91%, known exploited since 3 November 2021.
- [CVE-2016-3643](https://www.edgeprotect.io/what-is/cve-2016-3643): SolarWinds Virtualization Manager Privilege Escalation Vulnerability. High, CVSS 7.8, chance of use in 30 days 3.7%, known exploited since 3 November 2021.

## Which Solarwinds flaws are most likely to be used?

Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days):

- [CVE-2024-28995](https://www.edgeprotect.io/what-is/cve-2024-28995): >99%, High (CVSS 8.6), known exploited
- [CVE-2021-31474](https://www.edgeprotect.io/what-is/cve-2021-31474): 94%, Critical (CVSS 9.8)
- [CVE-2024-28987](https://www.edgeprotect.io/what-is/cve-2024-28987): 93%, Critical (CVSS 9.1), known exploited
- [CVE-2015-5371](https://www.edgeprotect.io/what-is/cve-2015-5371): 93%, Critical (CVSS 10.0)
- [CVE-2024-0692](https://www.edgeprotect.io/what-is/cve-2024-0692): 92%, High (CVSS 8.8)
- [CVE-2020-10148](https://www.edgeprotect.io/what-is/cve-2020-10148): 92%, Critical (CVSS 9.8), known exploited
- [CVE-2021-35211](https://www.edgeprotect.io/what-is/cve-2021-35211): 91%, Critical (CVSS 9.0), known exploited
- [CVE-2020-27871](https://www.edgeprotect.io/what-is/cve-2020-27871): 91%, High (CVSS 7.2)
- [CVE-2004-2111](https://www.edgeprotect.io/what-is/cve-2004-2111): 87%, High (CVSS 8.5)
- [CVE-2004-0330](https://www.edgeprotect.io/what-is/cve-2004-0330): 85%, Critical (CVSS 10.0)

## All Solarwinds products we track

72 products with at least one tracked version, most vulnerabilities first:

- [Orion Platform](https://www.edgeprotect.io/product/solarwinds/orion_platform): 49 vulnerabilities, 20 versions
- [Access Rights Manager](https://www.edgeprotect.io/product/solarwinds/access_rights_manager): 32 vulnerabilities, 15 versions
- [Serv-U](https://www.edgeprotect.io/product/solarwinds/serv-u): 31 vulnerabilities, 21 versions
- [Solarwinds Platform](https://www.edgeprotect.io/product/solarwinds/solarwinds_platform): 27 vulnerabilities, 16 versions
- [Serv-U File Server](https://www.edgeprotect.io/product/solarwinds/serv-u_file_server): 20 vulnerabilities, 101 versions
- [Web Help Desk](https://www.edgeprotect.io/product/solarwinds/web_help_desk): 11 vulnerabilities, 28 versions
- [Serv-U FTP Server](https://www.edgeprotect.io/product/solarwinds/serv-u_ftp_server): 11 vulnerabilities, 12 versions
- [Orion Network Performance Monitor](https://www.edgeprotect.io/product/solarwinds/orion_network_performance_monitor): 9 vulnerabilities, 22 versions
- [N-Central](https://www.edgeprotect.io/product/solarwinds/n-central): 9 vulnerabilities, 6 versions
- [Database Performance Analyzer](https://www.edgeprotect.io/product/solarwinds/database_performance_analyzer): 9 vulnerabilities, 6 versions
- [Network Performance Monitor](https://www.edgeprotect.io/product/solarwinds/network_performance_monitor): 8 vulnerabilities, 14 versions
- [Network Configuration Manager](https://www.edgeprotect.io/product/solarwinds/network_configuration_manager): 7 vulnerabilities, 5 versions
- [Dameware Mini Remote Control](https://www.edgeprotect.io/product/solarwinds/dameware_mini_remote_control): 7 vulnerabilities, 81 versions
- [Tftp Server](https://www.edgeprotect.io/product/solarwinds/tftp_server): 6 vulnerabilities, 12 versions
- [Webhelpdesk](https://www.edgeprotect.io/product/solarwinds/webhelpdesk): 6 vulnerabilities, 11 versions
- [Kiwi Syslog Server](https://www.edgeprotect.io/product/solarwinds/kiwi_syslog_server): 5 vulnerabilities, 13 versions
- [Log and Event Manager](https://www.edgeprotect.io/product/solarwinds/log_and_event_manager): 5 vulnerabilities, 12 versions
- [Security Event Manager](https://www.edgeprotect.io/product/solarwinds/security_event_manager): 4 vulnerabilities, 2 versions
- [Orion Web Performance Monitor](https://www.edgeprotect.io/product/solarwinds/orion_web_performance_monitor): 4 vulnerabilities, 2 versions
- [Storage Manager](https://www.edgeprotect.io/product/solarwinds/storage_manager): 3 vulnerabilities, 2 versions
- [Patch Manager](https://www.edgeprotect.io/product/solarwinds/patch_manager): 3 vulnerabilities, 13 versions
- [Virtualization Manager](https://www.edgeprotect.io/product/solarwinds/virtualization_manager): 3 vulnerabilities, 15 versions
- Log & Event Manager: 3 vulnerabilities, 1 version
- [Server and Application Monitor](https://www.edgeprotect.io/product/solarwinds/server_and_application_monitor): 3 vulnerabilities, 15 versions
- [Kiwi Cattools](https://www.edgeprotect.io/product/solarwinds/kiwi_cattools): 2 vulnerabilities, 12 versions
- [Serv-U Mft Server](https://www.edgeprotect.io/product/solarwinds/serv-u_mft_server): 2 vulnerabilities, 8 versions
- [Netpath](https://www.edgeprotect.io/product/solarwinds/netpath): 2 vulnerabilities, 1 version
- Sftp/scp Server: 2 vulnerabilities, 1 version
- [Network Performance Monitor Orion Platform 2018 Netpath](https://www.edgeprotect.io/product/solarwinds/network_performance_monitor_orion_platform_2018_netpath): 1 vulnerability, 1 version
- [Advanced Monitoring Agent](https://www.edgeprotect.io/product/solarwinds/advanced_monitoring_agent): 1 vulnerability, 1 version
- [Backup Profiler](https://www.edgeprotect.io/product/solarwinds/backup_profiler): 1 vulnerability, 1 version
- [Dameware](https://www.edgeprotect.io/product/solarwinds/dameware): 1 vulnerability, 1 version
- [Dameware Remote Support](https://www.edgeprotect.io/product/solarwinds/dameware_remote_support): 1 vulnerability, 26 versions
- [Dynamips](https://www.edgeprotect.io/product/solarwinds/dynamips): 1 vulnerability, 1 version
- Engineer's Toolset: 1 vulnerability, 1 version
- [Firewall Security Manager](https://www.edgeprotect.io/product/solarwinds/firewall_security_manager): 1 vulnerability, 1 version
- [FTP Voyager](https://www.edgeprotect.io/product/solarwinds/ftp_voyager): 1 vulnerability, 1 version
- [Help Desk](https://www.edgeprotect.io/product/solarwinds/help_desk): 1 vulnerability, 1 version
- [IP Address Manager Web Interface](https://www.edgeprotect.io/product/solarwinds/ip_address_manager_web_interface): 1 vulnerability, 1 version
- [Managed Service Provider Patch Management Engine](https://www.edgeprotect.io/product/solarwinds/managed_service_provider_patch_management_engine): 1 vulnerability, 1 version
- [Network Performance Monitor Orion Platform 2018 Npm](https://www.edgeprotect.io/product/solarwinds/network_performance_monitor_orion_platform_2018_npm): 1 vulnerability, 1 version
- [Orion IP Address Manager](https://www.edgeprotect.io/product/solarwinds/orion_ip_address_manager): 1 vulnerability, 1 version
- [Orion Job Scheduler](https://www.edgeprotect.io/product/solarwinds/orion_job_scheduler): 1 vulnerability, 1 version
- [Orion Netflow Traffic Analyzer](https://www.edgeprotect.io/product/solarwinds/orion_netflow_traffic_analyzer): 1 vulnerability, 1 version
- [Orion Network Configuration Manager](https://www.edgeprotect.io/product/solarwinds/orion_network_configuration_manager): 1 vulnerability, 1 version
- [Orion Server and Application Manager](https://www.edgeprotect.io/product/solarwinds/orion_server_and_application_manager): 1 vulnerability, 1 version
- [Orion User Device Tracker](https://www.edgeprotect.io/product/solarwinds/orion_user_device_tracker): 1 vulnerability, 1 version
- Orion VOIP & Network Quality Manager: 1 vulnerability, 1 version
- [Pingdom](https://www.edgeprotect.io/product/solarwinds/pingdom): 1 vulnerability, 1 version
- [Serv-U Managed File Transfer](https://www.edgeprotect.io/product/solarwinds/serv-u_managed_file_transfer): 1 vulnerability, 2 versions
- [SQL Sentry](https://www.edgeprotect.io/product/solarwinds/sql_sentry): 1 vulnerability, 1 version
- [Storage Profiler](https://www.edgeprotect.io/product/solarwinds/storage_profiler): 1 vulnerability, 1 version
- [Storage Resource Monitor](https://www.edgeprotect.io/product/solarwinds/storage_resource_monitor): 1 vulnerability, 16 versions
- [Scp Server](https://www.edgeprotect.io/product/solarwinds/scp_server): 0 vulnerabilities, 2 versions
- [Observability Self-Hosted](https://www.edgeprotect.io/product/solarwinds/observability_self-hosted): 0 vulnerabilities, 1 version
- [Netflow Realtime](https://www.edgeprotect.io/product/solarwinds/netflow_realtime): 0 vulnerabilities, 1 version
- [Log Forwarder for Windows](https://www.edgeprotect.io/product/solarwinds/log_forwarder_for_windows): 0 vulnerabilities, 1 version
- [Job Engine](https://www.edgeprotect.io/product/solarwinds/job_engine): 0 vulnerabilities, 2 versions
- [Ipmonitor](https://www.edgeprotect.io/product/solarwinds/ipmonitor): 0 vulnerabilities, 2 versions
- [Toolset](https://www.edgeprotect.io/product/solarwinds/toolset): 0 vulnerabilities, 2 versions
- [Integrated Virtual Infrastructure Monitor](https://www.edgeprotect.io/product/solarwinds/integrated_virtual_infrastructure_monitor): 0 vulnerabilities, 1 version
- [Information Service](https://www.edgeprotect.io/product/solarwinds/information_service): 0 vulnerabilities, 1 version
- [Exchange Monitor](https://www.edgeprotect.io/product/solarwinds/exchange_monitor): 0 vulnerabilities, 1 version
- [Dameware Mini Remote Control Client Agent Service](https://www.edgeprotect.io/product/solarwinds/dameware_mini_remote_control_client_agent_service): 0 vulnerabilities, 1 version
- [Engineers Edition](https://www.edgeprotect.io/product/solarwinds/engineers_edition): 0 vulnerabilities, 1 version
- [Collector](https://www.edgeprotect.io/product/solarwinds/collector): 0 vulnerabilities, 1 version
- [Advanced Subnet Calculator](https://www.edgeprotect.io/product/solarwinds/advanced_subnet_calculator): 0 vulnerabilities, 1 version
- [Orion Network Atlas](https://www.edgeprotect.io/product/solarwinds/orion_network_atlas): 0 vulnerabilities, 1 version
- [Orion Core Services](https://www.edgeprotect.io/product/solarwinds/orion_core_services): 0 vulnerabilities, 1 version
- [Damewire Mini Remote Control](https://www.edgeprotect.io/product/solarwinds/damewire_mini_remote_control): 0 vulnerabilities, 1 version
- [Real-Time Bandwidth Monitor](https://www.edgeprotect.io/product/solarwinds/real-time_bandwidth_monitor): 0 vulnerabilities, 1 version
- [SAN Monitor for Emc Clariion](https://www.edgeprotect.io/product/solarwinds/san_monitor_for_emc_clariion): 0 vulnerabilities, 1 version

## Questions

### How many vulnerabilities does Solarwinds have?

Our catalogue lists 290 published vulnerabilities across 75 products and 556 versions from Solarwinds. The most recent Solarwinds flaw added to the known-exploited list is CVE-2026-28318, on 5 June 2026.

### Which Solarwinds vulnerabilities are being exploited?

8 Solarwinds vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2026-28318, CVE-2024-28987 and CVE-2024-28986. The full list is on this page.

### Which Solarwinds product has the most vulnerabilities?

Orion Platform, with 49 published vulnerabilities. Its own page lists the ones known to be exploited.

### How do I get alerts for new Solarwinds vulnerabilities?

Create a EdgeProtect account and track the Solarwinds products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.

## Running Solarwinds?

EdgeProtect keeps checking for you:

- **Tell us what you run.** Pick your software from a list, or let us work it out from your website.
- **We match it to every flaw.** Over 400,000 published flaws, checked against your list.
- **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it.
- **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools.

Start free (no card, nothing to install): https://www.edgeprotect.io/register
Book a demo: https://www.edgeprotect.io/contact