MSRXSolarWinds vulnerabilities being exploited
4 SolarWinds flaws were confirmed exploited in the wild in the past 365 days, 1 used in ransomware, across 2 products: Serv-U, Web Help Desk. If you run any of them, patch these first.
| Added | Exploited vulnerability | Fix by |
|---|---|---|
| 2026-06-05 | CVE-2026-28318 Serv-U SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication. | 2026-06-19 |
| 2026-03-09 | CVE-2025-26399 Web Help Desk ransomwareSolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine. | 2026-03-12 |
| 2026-02-12 | CVE-2025-40536 Web Help Desk SolarWinds Web Help Desk Security Control Bypass Vulnerability SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality. | 2026-02-15 |
| 2026-02-03 | CVE-2025-40551 Web Help Desk SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication. | 2026-02-06 |
Source: CISA Known Exploited Vulnerabilities catalog 2026.10.29 (live). A listing means some versions are affected: check yours in the advisory. Guidance only.