SolarWinds Web Help Desk known exploited vulnerabilities, ranked
CISA lists 5 SolarWinds Web Help Desk CVEs as exploited in the wild. 3 were added in the last 12 months and 1 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2024-28987: EPSS 93.3%, added 2024-10-15
- CVE-2025-26399: EPSS 89.5%, used in ransomware, added 2026-03-09
- CVE-2024-28986: EPSS 84.6%, added 2024-08-15
- CVE-2025-40551: EPSS 84.2%, added 2026-02-03
- CVE-2025-40536: EPSS 73.6%, added 2026-02-12
All 5 SolarWinds Web Help Desk CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2024-28987 | Web Help Desk Hardcoded Credential | 93.3% | – | 2024-10-15 | 2024-11-05 |
| 2 | CVE-2025-26399 | Web Help Desk Deserialization of Untrusted Data | 89.5% | Yes | 2026-03-09 | 2026-03-12 |
| 3 | CVE-2024-28986 | Web Help Desk Deserialization of Untrusted Data | 84.6% | – | 2024-08-15 | 2024-09-05 |
| 4 | CVE-2025-40551 | Web Help Desk Deserialization of Untrusted Data | 84.2% | – | 2026-02-03 | 2026-02-06 |
| 5 | CVE-2025-40536 | Web Help Desk Security Control Bypass | 73.6% | – | 2026-02-12 | 2026-02-15 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all SolarWinds KEV CVEs · free KEV badge for SolarWinds · all vendors