Exploitation timeline
Threadlinqs has recorded 29 SolarWinds CVEs published between and . The busiest month was 2024-07 (13 new CVEs). 5 of them (17%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.
Most exploited vulnerabilities
Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 29 of 29 tracked SolarWinds CVEs.
- CVE-2024-28987critical 9.1KEVEPSS 94.3%
- CVE-2025-40551critical 9.8KEVEPSS 89.9%
- CVE-2024-28986critical 9.8KEVEPSS 75%
- CVE-2025-40536high 8.1KEVEPSS 70.7%
- CVE-2025-26399critical 9.8KEVEPSS 32.2%
- CVE-2024-28075critical 9EPSS 73.6%
- CVE-2024-28991critical 9EPSS 30.9%
- CVE-2025-40553critical 9.8RansomwareEPSS 14.5%
- CVE-2024-23469critical 9.6EPSS 10.5%
- CVE-2024-28988critical 9.8EPSS 9.8%
- CVE-2025-40552critical 9.8RansomwareEPSS 7.5%
- CVE-2024-23472critical 9.6EPSS 7.5%
- CVE-2025-40554critical 9.8RansomwareEPSS 6.1%
- CVE-2024-23467critical 9.6EPSS 3.4%
- CVE-2024-23466critical 9.6EPSS 3.2%
- CVE-2024-23470critical 9.6EPSS 2%
- CVE-2024-23471critical 9.6EPSS 1.6%
- CVE-2026-28326high 8.8EPSS 0.7%
- CVE-2026-28323critical 9.8EPSS 0.6%
- CVE-2024-23468high 7.6EPSS 0.6%
- CVE-2024-28993high 7.6EPSS 0.6%
- CVE-2024-28992high 7.6EPSS 0.4%
- CVE-2024-23475critical 9.6EPSS 0.2%
- CVE-2024-23473high 8.6EPSS 0.1%
- CVE-2024-28074critical 9.6EPSS 0.1%
- CVE-2024-23474high 7.6EPSS 0.1%
- CVE-2024-23465high 8.3EPSS 0%
- CVE-2024-28990medium 6.3EPSS 0%
- CVE-2025-40537high 7.5EPSS 0%
Products affected
Threadlinqs normalises CPE and CNA product records across all 29 CVEs; 2 distinct SolarWinds products are affected. The most frequently affected:
- Access Rights Manager 18 CVEs
- Web Help Desk 11 CVEs
Threat activity
8 tracked threat campaigns reference SolarWinds products or exploit SolarWinds CVEs:
- SolarWinds Access Rights Manager Hard-Coded Cryptographic Key (CVE-2026-28326) Enables Unauthenticated RCECRITICAL
- GOLD ENCOUNTER / Payouts King Ransomware Campaign Targeting Business Managers: 351 Victims Across 334 OrganizationsHIGH
- CVE-2026-28323: SolarWinds Web Help Desk SAML Authentication BypassCRITICAL
- SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities (CVE-2026-28302 to CVE-2026-28321) Including Root RCE, IDOR-Chained Privilege Escalation, and Broken Access ControlCRITICAL
- SolarWinds Serv-U DoS (CVE-2026-28318) — Actively Exploited Uncontrolled Resource Consumption via Content-Encoding: deflate POSTHIGH
- SolarWinds Web Help Desk Pre-Auth RCE Chain (CVE-2025-40552, CVE-2025-40553, CVE-2025-40554)CRITICAL
- SolarWinds Web Help Desk Deserialization RCE - CISA KEVCRITICAL
- SolarWinds Access Rights Manager (ARM) Systemic Deserialization RCE — 17 CVEs, 6 Unauth SYSTEM RCE, Access Control ParadoxCRITICAL
How to prioritise SolarWinds patching
This order follows the data Threadlinqs holds for SolarWinds, not a generic severity checklist:
- 5 of 29 SolarWinds CVEs (17%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2024-28987, CVE-2025-40551, CVE-2024-28986.
- 3 CVEs are known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems.
- Outside KEV, the highest EPSS scores are CVE-2024-28075 (73.6%), CVE-2024-28991 (30.9%), CVE-2025-40553 (14.5%).
- 19 CVEs score Critical and 9 High on CVSS v3 (maximum 9.8, average 9); sequence these after KEV and high-EPSS items.
- 1 CVE has a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.
About this data
Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily.