SolarWinds

CVEs currently on EVULNABLE's Priority Feed for SolarWinds, and this vendor's own CISA KEV history.

CISA KEV additions over time

Weekly additions to the KEV catalog, last 26 weeks. Ransomware-linked additions are the base of each bar. Ransomware-linked as currently marked by CISA; recent weeks can rise as CISA updates entries.

20 Apr – 12 Oct; busiest week: 1 added.

May

Jun

Jul

Aug

Sep

Oct

Not ransomware-linked
Ransomware-linked
This week (so far)

CISA KEV additions per week, last 26 weeks
Week of	Added to KEV	Ransomware-linked
2026-04-20	0	0
2026-04-27	0	0
2026-05-04	0	0
2026-05-11	0	0
2026-05-18	0	0
2026-05-25	0	0
2026-06-01	1	0
2026-06-08	0	0
2026-06-15	0	0
2026-06-22	0	0
2026-06-29	0	0
2026-07-06	0	0
2026-07-13	0	0
2026-07-20	0	0
2026-07-27	0	0
2026-08-03	0	0
2026-08-10	0	0
2026-08-17	0	0
2026-08-24	0	0
2026-08-31	0	0
2026-09-07	0	0
2026-09-14	0	0
2026-09-21	0	0
2026-09-28	0	0
2026-10-05	0	0
2026-10-12 (so far)	0	0

In EVULNABLE's ranked feed

Showing all 11 SolarWinds CVEs in EVULNABLE's ranked feed.

#1 94 Immediate CVE-2025-26399 ExigentCISA federal deadline · Overdue by 7 monthsRansomwareCISA KEV SolarWinds — SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

EVRS 94/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS89.5% · 99.79th pctlKEV since2026-03-09

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#2 92 Immediate CVE-2021-35211 ExigentKEV since 2021 · listed over a yearRansomwareCISA KEV SolarWinds — SolarWinds Serv-U Remote Code Execution Vulnerability

EVRS 92/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS10.0 (NVD)EPSS91.2% · 99.81st pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and associated with known ransomware campaigns.

Full CVE page NVD ↗CISA KEV ↗

#3 86 Immediate CVE-2025-40551 CISA federal deadline · Overdue by 8 monthsCISA KEV SolarWinds — SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

EVRS 86/100 · EVRS priority: Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS84.2% · 99.69th pctlKEV since2026-02-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.842.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#4 85 Immediate CVE-2024-28987 ExigentKEV since 2024 · listed over a yearCISA KEV SolarWinds — SolarWinds Web Help Desk Hardcoded Credential Vulnerability

EVRS 85/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.1 (NVD)EPSS93.3% · 99.84th pctlKEV since2024-10-15

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.933.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#5 85 Immediate CVE-2020-10148 ExigentKEV since 2021 · listed over a yearCISA KEV SolarWinds — SolarWinds Orion Authentication Bypass Vulnerability

EVRS 85/100 · EVRS priority: Immediate · Exigent, a flag within Immediate. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS92.0% · 99.82nd pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.920.

Full CVE page NVD ↗CISA KEV ↗

#6 84 Urgent CVE-2024-28995 KEV since 2024 · listed over a yearCISA KEV SolarWinds — SolarWinds Serv-U Path Traversal Vulnerability

EVRS 84/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS99.6% · 99.95th pctlKEV since2024-07-17

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.996.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#7 83 Urgent CVE-2024-28986 KEV since 2024 · listed over a yearCISA KEV SolarWinds — SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

EVRS 83/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS84.6% · 99.7th pctlKEV since2024-08-15

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.846.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#8 83 Urgent CVE-2025-40536 CISA federal deadline · Overdue by 8 monthsCISA KEV SolarWinds — SolarWinds Web Help Desk Security Control Bypass Vulnerability

EVRS 83/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS9.8 (NVD)EPSS73.6% · 99.47th pctlKEV since2026-02-12

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.736.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗

#9 75 Urgent CVE-2016-3643 KEV since 2021 · listed over a yearCISA KEV SolarWinds — SolarWinds Virtualization Manager Privilege Escalation Vulnerability

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.8 (NVD)EPSS3.7% · 89.5th pctlKEV since2021-11-03

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.037.

Full CVE page NVD ↗CISA KEV ↗

#10 75 Urgent CVE-2021-35247 KEV since 2022 · listed over a yearCISA KEV SolarWinds — SolarWinds Serv-U Improper Input Validation Vulnerability

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS5.3 (NVD)EPSS3.5% · 88.8th pctlKEV since2022-01-21

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.035.

Full CVE page NVD ↗CISA KEV ↗

#11 75 Urgent CVE-2026-28318 CISA federal deadline · Overdue by 4 monthsCISA KEV SolarWinds — SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability

EVRS 75/100 · EVRS priority: Urgent. CVSS severity and EPSS are separate measurements, shown below.

CVSS7.5 (NVD)EPSS1.9% · 79.8th pctlKEV since2026-06-05

Why it matters: Listed in the CISA KEV catalog, and an EPSS probability of 0.019.

Full CVE page NVD ↗CISA KEV ↗Vendor Advisory ↗