{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T18:10:31.291Z",
  "tag": {
    "id": "solarwinds",
    "label": "SolarWinds",
    "isStack": false,
    "url": "https://pwn.watch/t/solarwinds",
    "feed": "https://pwn.watch/t/solarwinds/feed.xml"
  },
  "counts": {
    "incidents": 7,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 7
  },
  "incidents": [
    {
      "slug": "solarwinds-serv-u-cve-2026-28318",
      "title": "SolarWinds Serv-U: SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability",
      "url": "https://pwn.watch/i/solarwinds-serv-u-cve-2026-28318",
      "json": "https://pwn.watch/i/solarwinds-serv-u-cve-2026-28318.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "SolarWinds Serv-U",
      "tags": [
        "solarwinds",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-28318"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-06-05",
      "closedAt": "2026-06-05",
      "updatedAt": "2026-06-05",
      "summary": "SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication. Added to CISA KEV on 2026-06-05.",
      "xPost": null
    },
    {
      "slug": "solarwinds-web-help-desk-cve-2025-26399",
      "title": "SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability",
      "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-26399",
      "json": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-26399.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "SolarWinds Web Help Desk",
      "tags": [
        "solarwinds",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-26399"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-03-09",
      "closedAt": "2026-03-09",
      "updatedAt": "2026-03-09",
      "summary": "SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine. Added to CISA KEV on 2026-03-09.",
      "xPost": null
    },
    {
      "slug": "solarwinds-web-help-desk-cve-2025-40536",
      "title": "SolarWinds Web Help Desk: SolarWinds Web Help Desk Security Control Bypass Vulnerability",
      "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-40536",
      "json": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-40536.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "SolarWinds Web Help Desk",
      "tags": [
        "solarwinds",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-40536"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-02-12",
      "closedAt": "2026-02-12",
      "updatedAt": "2026-02-12",
      "summary": "SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality. Added to CISA KEV on 2026-02-12.",
      "xPost": null
    },
    {
      "slug": "solarwinds-web-help-desk-cve-2025-40551",
      "title": "SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability",
      "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-40551",
      "json": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-40551.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "SolarWinds Web Help Desk",
      "tags": [
        "solarwinds",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2025-40551"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-02-03",
      "closedAt": "2026-02-03",
      "updatedAt": "2026-02-03",
      "summary": "SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication. Added to CISA KEV on 2026-02-03.",
      "xPost": null
    },
    {
      "slug": "solarwinds-web-help-desk-cve-2024-28987",
      "title": "SolarWinds Web Help Desk Hardcoded Credential",
      "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2024-28987",
      "json": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2024-28987.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "SolarWinds Web Help Desk",
      "tags": [
        "solarwinds",
        "web-help-desk",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-28987"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-08-21",
      "closedAt": "2024-10-15",
      "updatedAt": "2024-10-15",
      "summary": "SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data. Added to the CISA KEV catalog on 2024-10-15.",
      "xPost": null
    },
    {
      "slug": "solarwinds-web-help-desk-cve-2024-28986",
      "title": "SolarWinds Web Help Desk Deserialization of Untrusted Data",
      "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2024-28986",
      "json": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2024-28986.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "SolarWinds Web Help Desk",
      "tags": [
        "solarwinds",
        "web-help-desk",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-28986"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-08-13",
      "closedAt": "2024-08-15",
      "updatedAt": "2024-08-15",
      "summary": "SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution. Added to the CISA KEV catalog on 2024-08-15.",
      "xPost": null
    },
    {
      "slug": "solarwinds-serv-u-cve-2024-28995",
      "title": "SolarWinds Serv-U Path Traversal",
      "url": "https://pwn.watch/i/solarwinds-serv-u-cve-2024-28995",
      "json": "https://pwn.watch/i/solarwinds-serv-u-cve-2024-28995.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "SolarWinds Serv-U",
      "tags": [
        "solarwinds",
        "serv-u",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-28995"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-06-06",
      "closedAt": "2024-07-17",
      "updatedAt": "2024-07-17",
      "summary": "SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine. Added to the CISA KEV catalog on 2024-07-17.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "solarwinds-serv-u-cve-2026-28318",
      "incidentTitle": "SolarWinds Serv-U: SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-06-05",
      "title": "CISA added CVE-2026-28318 to the KEV catalog (due 2026-06-19).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/solarwinds-serv-u-cve-2026-28318"
    },
    {
      "incident": "solarwinds-web-help-desk-cve-2025-26399",
      "incidentTitle": "SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-03-09",
      "title": "CISA added CVE-2025-26399 to the KEV catalog (due 2026-03-12).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-26399"
    },
    {
      "incident": "solarwinds-web-help-desk-cve-2025-40536",
      "incidentTitle": "SolarWinds Web Help Desk: SolarWinds Web Help Desk Security Control Bypass Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-02-12",
      "title": "CISA added CVE-2025-40536 to the KEV catalog (due 2026-02-15).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-40536"
    },
    {
      "incident": "solarwinds-web-help-desk-cve-2025-40551",
      "incidentTitle": "SolarWinds Web Help Desk: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-02-03",
      "title": "CISA added CVE-2025-40551 to the KEV catalog (due 2026-02-06).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2025-40551"
    },
    {
      "incident": "solarwinds-web-help-desk-cve-2024-28987",
      "incidentTitle": "SolarWinds Web Help Desk Hardcoded Credential",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-15",
      "title": "CISA added CVE-2024-28987 to the KEV catalog (federal deadline 2024-11-05)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2024-28987"
    },
    {
      "incident": "solarwinds-web-help-desk-cve-2024-28987",
      "incidentTitle": "SolarWinds Web Help Desk Hardcoded Credential",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-21",
      "title": "CVE-2024-28987 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-28987",
      "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2024-28987"
    },
    {
      "incident": "solarwinds-web-help-desk-cve-2024-28986",
      "incidentTitle": "SolarWinds Web Help Desk Deserialization of Untrusted Data",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-15",
      "title": "CISA added CVE-2024-28986 to the KEV catalog (federal deadline 2024-09-05)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2024-28986"
    },
    {
      "incident": "solarwinds-web-help-desk-cve-2024-28986",
      "incidentTitle": "SolarWinds Web Help Desk Deserialization of Untrusted Data",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-13",
      "title": "CVE-2024-28986 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-28986",
      "url": "https://pwn.watch/i/solarwinds-web-help-desk-cve-2024-28986"
    },
    {
      "incident": "solarwinds-serv-u-cve-2024-28995",
      "incidentTitle": "SolarWinds Serv-U Path Traversal",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-07-17",
      "title": "CISA added CVE-2024-28995 to the KEV catalog (federal deadline 2024-08-07)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/solarwinds-serv-u-cve-2024-28995"
    },
    {
      "incident": "solarwinds-serv-u-cve-2024-28995",
      "incidentTitle": "SolarWinds Serv-U Path Traversal",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-06",
      "title": "CVE-2024-28995 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-28995",
      "url": "https://pwn.watch/i/solarwinds-serv-u-cve-2024-28995"
    }
  ]
}