{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: SolarWinds vulnerabilities","home_page_url":"https://patchfirst.co/vendor/solarwinds/","feed_url":"https://patchfirst.co/feed/vendor/solarwinds.json","description":"New and newly exploited SolarWinds CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-28323","url":"https://patchfirst.co/cve/CVE-2026-28323/","title":"CVE-2026-28323: SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability","content_text":"SolarWinds · Web Help Desk. Not in CISA KEV. EPSS 1.0% (higher than 63.6% of CVEs). CVSS 9.8 CRITICAL. Named in 5 threat reports. Priority 31.2 of 100.","summary":"SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability","date_published":"2026-07-30T00:00:00.000Z","date_modified":"2026-07-31T03:56:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":31.2,"kev":null,"epss":{"score":0.01026,"percentile":0.63581},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SolarWinds","product":"Web Help Desk","techniqueIds":[],"reportCount":5,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2026-28318#kev","url":"https://patchfirst.co/cve/CVE-2026-28318/","title":"[KEV] CVE-2026-28318: SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability","content_text":"SolarWinds · Serv-U. In CISA KEV since 2026-06-05. ENISA EUVD lists it as exploited. EPSS 43.7% (higher than 98.7% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1499 Endpoint Denial of Service. Priority 73.0 of 100.","summary":"SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability","date_published":"2026-06-05T00:00:00.000Z","date_modified":"2026-10-21T11:17:07.000Z","tags":["kev","public-exploit","T1190","T1499"],"_patchfirst":{"reason":"kev","priority":73,"kev":{"dateAdded":"2026-06-05","ransomware":false},"epss":{"score":0.43651,"percentile":0.9874},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"SolarWinds","product":"Serv-U","techniqueIds":["T1190","T1499"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2026-28299","url":"https://patchfirst.co/cve/CVE-2026-28299/","title":"CVE-2026-28299: SolarWinds Web Help Desk Denial-of-Service Vulnerability","content_text":"SolarWinds · Web Help Desk. Not in CISA KEV. EPSS 0.7% (higher than 53.9% of CVEs). CVSS 8.2 HIGH. Named in 5 threat reports. Priority 29.0 of 100.","summary":"SolarWinds Web Help Desk Denial-of-Service Vulnerability","date_published":"2026-06-02T00:00:00.000Z","date_modified":"2026-06-03T22:19:15.000Z","tags":[],"_patchfirst":{"reason":"published","priority":29,"kev":null,"epss":{"score":0.0072,"percentile":0.53885},"cvss":{"score":8.2,"severity":"HIGH","version":"3.1"},"vendor":"SolarWinds","product":"Web Help Desk","techniqueIds":[],"reportCount":5,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2025-26399#kev","url":"https://patchfirst.co/cve/CVE-2025-26399/","title":"[KEV] CVE-2025-26399: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability","content_text":"SolarWinds · Web Help Desk. In CISA KEV since 2026-03-09, known ransomware use. ENISA EUVD lists it as exploited. EPSS 90.1% (higher than 99.8% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 84.8 of 100.","summary":"SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability","date_published":"2026-03-09T00:00:00.000Z","date_modified":"2026-10-11T20:10:00.000Z","tags":["kev","ransomware","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":84.8,"kev":{"dateAdded":"2026-03-09","ransomware":true},"epss":{"score":0.9012,"percentile":0.99795},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SolarWinds","product":"Web Help Desk","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-40536#kev","url":"https://patchfirst.co/cve/CVE-2025-40536/","title":"[KEV] CVE-2025-40536: SolarWinds Web Help Desk Security Control Bypass Vulnerability","content_text":"SolarWinds · Web Help Desk. In CISA KEV since 2026-02-12. ENISA EUVD lists it as exploited. EPSS 73.6% (higher than 99.47% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 74.8 of 100.","summary":"SolarWinds Web Help Desk Security Control Bypass Vulnerability","date_published":"2026-02-12T00:00:00.000Z","date_modified":"2026-06-17T09:21:43.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":74.8,"kev":{"dateAdded":"2026-02-12","ransomware":false},"epss":{"score":0.73562,"percentile":0.99466},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SolarWinds","product":"Web Help Desk","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-40551#kev","url":"https://patchfirst.co/cve/CVE-2025-40551/","title":"[KEV] CVE-2025-40551: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability","content_text":"SolarWinds · Web Help Desk. In CISA KEV since 2026-02-03. ENISA EUVD lists it as exploited. EPSS 84.2% (higher than 99.69% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 74.8 of 100.","summary":"SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability","date_published":"2026-02-03T00:00:00.000Z","date_modified":"2026-06-17T09:21:44.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":74.8,"kev":{"dateAdded":"2026-02-03","ransomware":false},"epss":{"score":0.84181,"percentile":0.99695},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SolarWinds","product":"Web Help Desk","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2025-40554","url":"https://patchfirst.co/cve/CVE-2025-40554/","title":"CVE-2025-40554: SolarWinds Web Help Desk Authentication Bypass Vulnerability","content_text":"SolarWinds · Web Help Desk. Not in CISA KEV. EPSS 60.6% (higher than 99.15% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 81.7 of 100.","summary":"SolarWinds Web Help Desk Authentication Bypass Vulnerability","date_published":"2026-01-28T00:00:00.000Z","date_modified":"2026-02-26T15:04:48.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":81.7,"kev":null,"epss":{"score":0.60642,"percentile":0.99145},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SolarWinds","product":"Web Help Desk","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-40553","url":"https://patchfirst.co/cve/CVE-2025-40553/","title":"CVE-2025-40553: SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability","content_text":"SolarWinds · Web Help Desk. Not in CISA KEV. EPSS 68.0% (higher than 99.32% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. Priority 76.7 of 100.","summary":"SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability","date_published":"2026-01-28T00:00:00.000Z","date_modified":"2026-02-27T04:55:46.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":76.7,"kev":null,"epss":{"score":0.67975,"percentile":0.99321},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SolarWinds","product":"Web Help Desk","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2024-28987#kev","url":"https://patchfirst.co/cve/CVE-2024-28987/","title":"[KEV] CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability","content_text":"SolarWinds · Web Help Desk. In CISA KEV since 2024-10-15. ENISA EUVD lists it as exploited. EPSS 93.3% (higher than 99.84% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 69.3 of 100.","summary":"SolarWinds Web Help Desk Hardcoded Credential Vulnerability","date_published":"2024-10-15T00:00:00.000Z","date_modified":"2026-06-17T07:22:12.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":69.3,"kev":{"dateAdded":"2024-10-15","ransomware":false},"epss":{"score":0.93299,"percentile":0.99836},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1"},"vendor":"SolarWinds","product":"Web Help Desk","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-28986#kev","url":"https://patchfirst.co/cve/CVE-2024-28986/","title":"[KEV] CVE-2024-28986: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability","content_text":"SolarWinds · Web Help Desk. In CISA KEV since 2024-08-15. ENISA EUVD lists it as exploited. EPSS 84.6% (higher than 99.7% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability","date_published":"2024-08-15T00:00:00.000Z","date_modified":"2026-06-17T07:22:12.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2024-08-15","ransomware":false},"epss":{"score":0.84628,"percentile":0.99704},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SolarWinds","product":"Web Help Desk","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-28995#kev","url":"https://patchfirst.co/cve/CVE-2024-28995/","title":"[KEV] CVE-2024-28995: SolarWinds Serv-U Path Traversal Vulnerability","content_text":"SolarWinds · Serv-U. In CISA KEV since 2024-07-17. ENISA EUVD lists it as exploited. EPSS 99.6% (higher than 99.95% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.2 of 100.","summary":"SolarWinds Serv-U Path Traversal Vulnerability","date_published":"2024-07-17T00:00:00.000Z","date_modified":"2026-06-17T07:22:13.000Z","tags":["kev","public-exploit","T1190","T1005"],"_patchfirst":{"reason":"kev","priority":68.2,"kev":{"dateAdded":"2024-07-17","ransomware":false},"epss":{"score":0.99614,"percentile":0.99949},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"SolarWinds","product":"Serv-U","techniqueIds":["T1190","T1005"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-28075","url":"https://patchfirst.co/cve/CVE-2024-28075/","title":"CVE-2024-28075: SolarWinds ARM Deserialization of Untrusted Data Remote Code Execution","content_text":"SolarWinds · Access Rights Manager. Not in CISA KEV. EPSS 78.0% (higher than 99.57% of CVEs). CVSS 9.0 CRITICAL. Priority 26.2 of 100.","summary":"SolarWinds ARM Deserialization of Untrusted Data Remote Code Execution","date_published":"2024-05-09T00:00:00.000Z","date_modified":"2024-08-02T00:48:48.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.2,"kev":null,"epss":{"score":0.78028,"percentile":0.99574},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1"},"vendor":"SolarWinds","product":"Access Rights Manager","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2024-0692","url":"https://patchfirst.co/cve/CVE-2024-0692/","title":"CVE-2024-0692: SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability","content_text":"SolarWinds  · Security Event Manager . Not in CISA KEV. EPSS 92.2% (higher than 99.82% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. Priority 66.8 of 100.","summary":"SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability","date_published":"2024-03-01T00:00:00.000Z","date_modified":"2025-04-16T20:48:48.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":66.8,"kev":null,"epss":{"score":0.92245,"percentile":0.99822},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"SolarWinds ","product":"Security Event Manager ","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2024-23478","url":"https://patchfirst.co/cve/CVE-2024-23478/","title":"CVE-2024-23478: SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution","content_text":"SolarWinds · Access Rights Manager. Not in CISA KEV. EPSS 81.6% (higher than 99.64% of CVEs). CVSS 8.0 HIGH. Priority 25.5 of 100.","summary":"SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution","date_published":"2024-02-15T00:00:00.000Z","date_modified":"2024-08-12T20:38:34.000Z","tags":[],"_patchfirst":{"reason":"published","priority":25.5,"kev":null,"epss":{"score":0.81588,"percentile":0.9964},"cvss":{"score":8,"severity":"HIGH","version":"3.1"},"vendor":"SolarWinds","product":"Access Rights Manager","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-23836","url":"https://patchfirst.co/cve/CVE-2023-23836/","title":"CVE-2023-23836: SolarWinds Platform Deserialization of Untrusted Data Vulnerability","content_text":"SolarWinds · SolarWinds Platform. Not in CISA KEV. EPSS 80.3% (higher than 99.62% of CVEs). CVSS 7.2 HIGH. Priority 26.3 of 100.","summary":"SolarWinds Platform Deserialization of Untrusted Data Vulnerability","date_published":"2023-02-15T00:00:00.000Z","date_modified":"2025-03-18T15:48:50.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.3,"kev":null,"epss":{"score":0.80298,"percentile":0.9962},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"SolarWinds","product":"SolarWinds Platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-38111","url":"https://patchfirst.co/cve/CVE-2022-38111/","title":"CVE-2022-38111: SolarWinds Platform Deserialization of Untrusted Data Vulnerability","content_text":"SolarWinds · SolarWinds Platform. Not in CISA KEV. EPSS 84.8% (higher than 99.71% of CVEs). CVSS 7.2 HIGH. Priority 26.3 of 100.","summary":"SolarWinds Platform Deserialization of Untrusted Data Vulnerability","date_published":"2023-02-15T00:00:00.000Z","date_modified":"2025-03-19T19:46:50.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.3,"kev":null,"epss":{"score":0.84803,"percentile":0.99708},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"SolarWinds","product":"SolarWinds Platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-38108","url":"https://patchfirst.co/cve/CVE-2022-38108/","title":"CVE-2022-38108: SolarWinds Platform Deserialization of Untrusted Data","content_text":"SolarWinds · SolarWinds Platform. Not in CISA KEV. EPSS 65.9% (higher than 99.27% of CVEs). CVSS 7.2 HIGH. Public exploit code exists. Priority 31.8 of 100.","summary":"SolarWinds Platform Deserialization of Untrusted Data","date_published":"2022-10-20T00:00:00.000Z","date_modified":"2025-05-08T15:22:21.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":31.8,"kev":null,"epss":{"score":0.65931,"percentile":0.9927},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1"},"vendor":"SolarWinds","product":"SolarWinds Platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-36958","url":"https://patchfirst.co/cve/CVE-2022-36958/","title":"CVE-2022-36958: SolarWinds Platform Deserialization of Untrusted Data","content_text":"SolarWinds · SolarWinds Platform. Not in CISA KEV. EPSS 81.5% (higher than 99.64% of CVEs). CVSS 8.8 HIGH. Priority 28.0 of 100.","summary":"SolarWinds Platform Deserialization of Untrusted Data","date_published":"2022-10-20T00:00:00.000Z","date_modified":"2025-05-08T13:25:48.000Z","tags":[],"_patchfirst":{"reason":"published","priority":28,"kev":null,"epss":{"score":0.81542,"percentile":0.9964},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"SolarWinds","product":"SolarWinds Platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-36961","url":"https://patchfirst.co/cve/CVE-2022-36961/","title":"CVE-2022-36961: Orion Platform SQL Injection Privilege Escalation Vulnerability","content_text":"SolarWinds · Orion Platform. Not in CISA KEV. EPSS 74.3% (higher than 99.49% of CVEs). CVSS 8.8 HIGH. Priority 27.4 of 100.","summary":"Orion Platform SQL Injection Privilege Escalation Vulnerability","date_published":"2022-09-30T00:00:00.000Z","date_modified":"2025-05-20T16:01:34.000Z","tags":[],"_patchfirst":{"reason":"published","priority":27.4,"kev":null,"epss":{"score":0.7432,"percentile":0.99489},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"SolarWinds","product":"Orion Platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-35250","url":"https://patchfirst.co/cve/CVE-2021-35250/","title":"CVE-2021-35250: Directory Transversal Vulnerability in Serv-U 15.3","content_text":"SolarWinds · Serv-U. Not in CISA KEV. EPSS 12.8% (higher than 96.3% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. Priority 66.1 of 100.","summary":"Directory Transversal Vulnerability in Serv-U 15.3","date_published":"2022-04-25T00:00:00.000Z","date_modified":"2024-09-16T23:31:12.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":66.1,"kev":null,"epss":{"score":0.12804,"percentile":0.96282},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1"},"vendor":"SolarWinds","product":"Serv-U","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2021-35247#kev","url":"https://patchfirst.co/cve/CVE-2021-35247/","title":"[KEV] CVE-2021-35247: SolarWinds Serv-U Improper Input Validation Vulnerability","content_text":"SolarWinds · Serv-U. In CISA KEV since 2022-01-21. ENISA EUVD lists it as exploited. EPSS 3.5% (higher than 89% of CVEs). CVSS 5.3 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application. Priority 59.5 of 100.","summary":"SolarWinds Serv-U Improper Input Validation Vulnerability","date_published":"2022-01-21T00:00:00.000Z","date_modified":"2026-06-17T03:57:22.000Z","tags":["kev","T1190"],"_patchfirst":{"reason":"kev","priority":59.5,"kev":{"dateAdded":"2022-01-21","ransomware":false},"epss":{"score":0.03453,"percentile":0.89004},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.1"},"vendor":"SolarWinds","product":"Serv-U","techniqueIds":["T1190"],"reportCount":0,"hasPublicExploit":false,"euvdExploited":true}},{"id":"CVE-2021-35232","url":"https://patchfirst.co/cve/CVE-2021-35232/","title":"CVE-2021-35232: Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries","content_text":"SolarWinds · Web Help Desk. Not in CISA KEV. EPSS 0.3% (higher than 25.3% of CVEs). CVSS 6.8 MEDIUM. Priority 46.4 of 100.","summary":"Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries","date_published":"2021-12-27T00:00:00.000Z","date_modified":"2024-09-17T03:44:02.000Z","tags":[],"_patchfirst":{"reason":"published","priority":46.4,"kev":null,"epss":{"score":0.00323,"percentile":0.25314},"cvss":{"score":6.8,"severity":"MEDIUM","version":"3.1"},"vendor":"SolarWinds","product":"Web Help Desk","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-35211#kev","url":"https://patchfirst.co/cve/CVE-2021-35211/","title":"[KEV] CVE-2021-35211: SolarWinds Serv-U Remote Code Execution Vulnerability","content_text":"SolarWinds · Serv-U. In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 91.2% (higher than 99.81% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1068 Exploitation for Privilege Escalation. Priority 80.0 of 100.","summary":"SolarWinds Serv-U Remote Code Execution Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T03:57:18.000Z","tags":["kev","ransomware","public-exploit","T1190","T1068"],"_patchfirst":{"reason":"kev","priority":80,"kev":{"dateAdded":"2021-11-03","ransomware":true},"epss":{"score":0.9116,"percentile":0.99809},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"SolarWinds","product":"Serv-U","techniqueIds":["T1190","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2020-10148#kev","url":"https://patchfirst.co/cve/CVE-2020-10148/","title":"[KEV] CVE-2020-10148: SolarWinds Orion Authentication Bypass Vulnerability","content_text":"SolarWinds · Orion. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 92.0% (higher than 99.82% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.8 of 100.","summary":"SolarWinds Orion Authentication Bypass Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T02:47:26.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":69.8,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.9198,"percentile":0.99819},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"SolarWinds","product":"Orion","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2016-3643#kev","url":"https://patchfirst.co/cve/CVE-2016-3643/","title":"[KEV] CVE-2016-3643: SolarWinds Virtualization Manager Privilege Escalation Vulnerability","content_text":"SolarWinds · Virtualization Manager. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 3.7% (higher than 89.7% of CVEs). CVSS 7.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1068 Exploitation for Privilege Escalation. Priority 66.4 of 100.","summary":"SolarWinds Virtualization Manager Privilege Escalation Vulnerability","date_published":"2021-11-03T00:00:00.000Z","date_modified":"2026-06-17T00:46:07.000Z","tags":["kev","public-exploit","T1078","T1068"],"_patchfirst":{"reason":"kev","priority":66.4,"kev":{"dateAdded":"2021-11-03","ransomware":false},"epss":{"score":0.03674,"percentile":0.89651},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1"},"vendor":"SolarWinds","product":"Virtualization Manager","techniqueIds":["T1078","T1068"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2021-35217","url":"https://patchfirst.co/cve/CVE-2021-35217/","title":"CVE-2021-35217: Insecure Deserialization of untrusted data causing Remote code execution vulnerability.","content_text":"SolarWinds · Orion Platform. Not in CISA KEV. EPSS 72.8% (higher than 99.45% of CVEs). CVSS 8.9 HIGH. Priority 27.2 of 100.","summary":"Insecure Deserialization of untrusted data causing Remote code execution vulnerability.","date_published":"2021-09-08T00:00:00.000Z","date_modified":"2024-09-16T20:58:13.000Z","tags":[],"_patchfirst":{"reason":"published","priority":27.2,"kev":null,"epss":{"score":0.72792,"percentile":0.99448},"cvss":{"score":8.9,"severity":"HIGH","version":"3.1"},"vendor":"SolarWinds","product":"Orion Platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-35215","url":"https://patchfirst.co/cve/CVE-2021-35215/","title":"CVE-2021-35215: ActionPluginBaseView Deserialization of Untrusted Data RCE","content_text":"SolarWinds · Orion Platform. Not in CISA KEV. EPSS 69.7% (higher than 99.37% of CVEs). CVSS 8.9 HIGH. Public exploit code exists. Priority 32.5 of 100.","summary":"ActionPluginBaseView Deserialization of Untrusted Data RCE","date_published":"2021-09-01T00:00:00.000Z","date_modified":"2024-09-16T19:52:15.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":32.5,"kev":null,"epss":{"score":0.69731,"percentile":0.99367},"cvss":{"score":8.9,"severity":"HIGH","version":"3.1"},"vendor":"SolarWinds","product":"Orion Platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2021-35218","url":"https://patchfirst.co/cve/CVE-2021-35218/","title":"CVE-2021-35218: Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability","content_text":"SolarWinds · Patch Manager. Not in CISA KEV. EPSS 76.4% (higher than 99.54% of CVEs). CVSS 8.9 HIGH. Priority 27.2 of 100.","summary":"Chart Endpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability","date_published":"2021-09-01T00:00:00.000Z","date_modified":"2024-08-04T00:33:51.000Z","tags":[],"_patchfirst":{"reason":"published","priority":27.2,"kev":null,"epss":{"score":0.76411,"percentile":0.9954},"cvss":{"score":8.9,"severity":"HIGH","version":"3.1"},"vendor":"SolarWinds","product":"Patch Manager","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-35216","url":"https://patchfirst.co/cve/CVE-2021-35216/","title":"CVE-2021-35216: Deserialization of Untrusted Data in Resource Controls Remote Code Execution","content_text":"SolarWinds · Patch Manager. Not in CISA KEV. EPSS 81.4% (higher than 99.64% of CVEs). CVSS 8.9 HIGH. Priority 27.2 of 100.","summary":"Deserialization of Untrusted Data in Resource Controls Remote Code Execution","date_published":"2021-09-01T00:00:00.000Z","date_modified":"2024-08-04T00:33:51.000Z","tags":[],"_patchfirst":{"reason":"published","priority":27.2,"kev":null,"epss":{"score":0.81402,"percentile":0.99637},"cvss":{"score":8.9,"severity":"HIGH","version":"3.1"},"vendor":"SolarWinds","product":"Patch Manager","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2021-31474","url":"https://patchfirst.co/cve/CVE-2021-31474/","title":"CVE-2021-31474: This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network…","content_text":"SolarWinds · Network Performance Monitor. Not in CISA KEV. EPSS 93.9% (higher than 99.84% of CVEs). CVSS 9.8 CRITICAL. Priority 27.5 of 100.","summary":"This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network…","date_published":"2021-05-21T00:00:00.000Z","date_modified":"2024-08-03T23:03:32.000Z","tags":[],"_patchfirst":{"reason":"published","priority":27.5,"kev":null,"epss":{"score":0.93939,"percentile":0.99845},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.0"},"vendor":"SolarWinds","product":"Network Performance Monitor","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2020-27871","url":"https://patchfirst.co/cve/CVE-2020-27871/","title":"CVE-2020-27871: This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion…","content_text":"SolarWinds · Orion Platform. Not in CISA KEV. EPSS 90.8% (higher than 99.8% of CVEs). CVSS 7.2 HIGH. Priority 25.0 of 100.","summary":"This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion…","date_published":"2021-02-10T00:00:00.000Z","date_modified":"2024-08-04T16:25:43.000Z","tags":[],"_patchfirst":{"reason":"published","priority":25,"kev":null,"epss":{"score":0.9083,"percentile":0.99805},"cvss":{"score":7.2,"severity":"HIGH","version":"3.0"},"vendor":"SolarWinds","product":"Orion Platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}}]}