# SolarWinds vulnerabilities & exploitation **CISA KEV** · **Ransomware** > As of 2026-10-05, Threadlinqs tracks 29 SolarWinds CVEs, 5 in the CISA Known Exploited Vulnerabilities catalog, 3 used in ransomware campaigns, linked to 8 tracked threat campaigns. **Data as of:** 2026-10-05 ## Exploitation timeline Threadlinqs has recorded 29 SolarWinds CVEs published between 2024-05-15 and 2026-09-15. The busiest month was 2024-07 (13 new CVEs). 5 of them (17%) are listed in CISA KEV, which means exploitation in the wild has been confirmed. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 29 of 29 tracked SolarWinds CVEs. - [CVE-2024-28987](https://intel.threadlinqs.com/cve/CVE-2024-28987) — CRITICAL 9.1 · KEV · EPSS 94.3% · 2024-08-21 - [CVE-2025-40551](https://intel.threadlinqs.com/cve/CVE-2025-40551) — CRITICAL 9.8 · KEV · EPSS 89.9% · 2026-01-28 - [CVE-2024-28986](https://intel.threadlinqs.com/cve/CVE-2024-28986) — CRITICAL 9.8 · KEV · EPSS 75% · 2024-08-13 - [CVE-2025-40536](https://intel.threadlinqs.com/cve/CVE-2025-40536) — HIGH 8.1 · KEV · EPSS 70.7% · 2026-01-28 - [CVE-2025-26399](https://intel.threadlinqs.com/cve/CVE-2025-26399) — CRITICAL 9.8 · KEV · EPSS 32.2% · 2025-09-23 - [CVE-2024-28075](https://intel.threadlinqs.com/cve/CVE-2024-28075) — CRITICAL 9 · EPSS 73.6% · 2024-05-14 - [CVE-2024-28991](https://intel.threadlinqs.com/cve/CVE-2024-28991) — CRITICAL 9 · EPSS 30.9% · 2024-09-12 - [CVE-2025-40553](https://intel.threadlinqs.com/cve/CVE-2025-40553) — CRITICAL 9.8 · Ransomware · EPSS 14.5% · 2026-01-28 - [CVE-2024-23469](https://intel.threadlinqs.com/cve/CVE-2024-23469) — CRITICAL 9.6 · EPSS 10.5% · 2024-07-17 - [CVE-2024-28988](https://intel.threadlinqs.com/cve/CVE-2024-28988) — CRITICAL 9.8 · EPSS 9.8% · 2025-09-01 - [CVE-2025-40552](https://intel.threadlinqs.com/cve/CVE-2025-40552) — CRITICAL 9.8 · Ransomware · EPSS 7.5% · 2026-01-28 - [CVE-2024-23472](https://intel.threadlinqs.com/cve/CVE-2024-23472) — CRITICAL 9.6 · EPSS 7.5% · 2024-07-17 - [CVE-2025-40554](https://intel.threadlinqs.com/cve/CVE-2025-40554) — CRITICAL 9.8 · Ransomware · EPSS 6.1% · 2026-01-28 - [CVE-2024-23467](https://intel.threadlinqs.com/cve/CVE-2024-23467) — CRITICAL 9.6 · EPSS 3.4% · 2024-07-17 - [CVE-2024-23466](https://intel.threadlinqs.com/cve/CVE-2024-23466) — CRITICAL 9.6 · EPSS 3.2% · 2024-07-17 - [CVE-2024-23470](https://intel.threadlinqs.com/cve/CVE-2024-23470) — CRITICAL 9.6 · EPSS 2% · 2024-07-17 - [CVE-2024-23471](https://intel.threadlinqs.com/cve/CVE-2024-23471) — CRITICAL 9.6 · EPSS 1.6% · 2024-07-17 - [CVE-2026-28326](https://intel.threadlinqs.com/cve/CVE-2026-28326) — HIGH 8.8 · EPSS 0.7% · 2026-09-17 - [CVE-2026-28323](https://intel.threadlinqs.com/cve/CVE-2026-28323) — CRITICAL 9.8 · EPSS 0.6% · 2026-07-30 - [CVE-2024-23468](https://intel.threadlinqs.com/cve/CVE-2024-23468) — HIGH 7.6 · EPSS 0.6% · 2024-07-17 - [CVE-2024-28993](https://intel.threadlinqs.com/cve/CVE-2024-28993) — HIGH 7.6 · EPSS 0.6% · 2024-07-17 - [CVE-2024-28992](https://intel.threadlinqs.com/cve/CVE-2024-28992) — HIGH 7.6 · EPSS 0.4% · 2024-07-17 - [CVE-2024-23475](https://intel.threadlinqs.com/cve/CVE-2024-23475) — CRITICAL 9.6 · EPSS 0.2% · 2024-07-17 - [CVE-2024-23473](https://intel.threadlinqs.com/cve/CVE-2024-23473) — HIGH 8.6 · EPSS 0.1% · 2024-05-14 - [CVE-2024-28074](https://intel.threadlinqs.com/cve/CVE-2024-28074) — CRITICAL 9.6 · EPSS 0.1% · 2024-07-17 - [CVE-2024-23474](https://intel.threadlinqs.com/cve/CVE-2024-23474) — HIGH 7.6 · EPSS 0.1% · 2024-07-17 - [CVE-2024-23465](https://intel.threadlinqs.com/cve/CVE-2024-23465) — HIGH 8.3 · EPSS 0% · 2024-07-17 - [CVE-2024-28990](https://intel.threadlinqs.com/cve/CVE-2024-28990) — MEDIUM 6.3 · EPSS 0% · 2024-09-12 - [CVE-2025-40537](https://intel.threadlinqs.com/cve/CVE-2025-40537) — HIGH 7.5 · EPSS 0% · 2026-01-28 ## Products affected Threadlinqs normalises CPE and CNA product records across all 29 CVEs; 2 distinct SolarWinds products are affected. The most frequently affected: - Access Rights Manager — 18 CVEs - Web Help Desk — 11 CVEs ## Threat activity 8 tracked threat campaigns reference SolarWinds products or exploit SolarWinds CVEs: - [SolarWinds Access Rights Manager Hard-Coded Cryptographic Key (CVE-2026-28326) Enables Unauthenticated RCE](https://intel.threadlinqs.com/threat/TL-2026-2585) — CRITICAL — 2026-09-19 - [GOLD ENCOUNTER / Payouts King Ransomware Campaign Targeting Business Managers: 351 Victims Across 334 Organizations](https://intel.threadlinqs.com/threat/TL-2026-1917) — HIGH — 2026-08-06 - [CVE-2026-28323: SolarWinds Web Help Desk SAML Authentication Bypass](https://intel.threadlinqs.com/threat/TL-2026-1789) — CRITICAL — 2026-07-31 - [SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities (CVE-2026-28302 to CVE-2026-28321) Including Root RCE, IDOR-Chained Privilege Escalation, and Broken Access Control](https://intel.threadlinqs.com/threat/TL-2026-1625) — CRITICAL — 2026-07-22 - [SolarWinds Serv-U DoS (CVE-2026-28318) — Actively Exploited Uncontrolled Resource Consumption via Content-Encoding: deflate POST](https://intel.threadlinqs.com/threat/TL-2026-0717) — HIGH — 2026-06-08 - [SolarWinds Web Help Desk Pre-Auth RCE Chain (CVE-2025-40552, CVE-2025-40553, CVE-2025-40554)](https://intel.threadlinqs.com/threat/TL-2026-1517) — CRITICAL — 2026-02-25 - [SolarWinds Web Help Desk Deserialization RCE - CISA KEV](https://intel.threadlinqs.com/threat/TL-2026-0060) — CRITICAL — 2026-02-03 - [SolarWinds Access Rights Manager (ARM) Systemic Deserialization RCE — 17 CVEs, 6 Unauth SYSTEM RCE, Access Control Paradox](https://intel.threadlinqs.com/threat/TL-2026-0016) — CRITICAL — 2026-02-02 ## How to prioritise SolarWinds patching This order follows the data Threadlinqs holds for SolarWinds, not a generic severity checklist: - 5 of 29 SolarWinds CVEs (17%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2024-28987](https://intel.threadlinqs.com/cve/CVE-2024-28987), [CVE-2025-40551](https://intel.threadlinqs.com/cve/CVE-2025-40551), [CVE-2024-28986](https://intel.threadlinqs.com/cve/CVE-2024-28986). - 3 CVEs are known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems. - Outside KEV, the highest EPSS scores are [CVE-2024-28075](https://intel.threadlinqs.com/cve/CVE-2024-28075) (73.6%), [CVE-2024-28991](https://intel.threadlinqs.com/cve/CVE-2024-28991) (30.9%), [CVE-2025-40553](https://intel.threadlinqs.com/cve/CVE-2025-40553) (14.5%). - 19 CVEs score Critical and 9 High on CVSS v3 (maximum 9.8, average 9); sequence these after KEV and high-EPSS items. - 1 CVE has a public exploit or proof of concept recorded, which shortens the time from disclosure to attack. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/solarwinds All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp