DaystoPatch

VendorsIT management

SolarWinds

SolarWinds makes IT operations and observability software, including the Orion platform, Serv-U file transfer, Web Help Desk and Access Rights Manager.

Response trend, 6 months
Not enough history
Open now
None
Latest incident
3 Jun 2026
Incidents on record
3

Response to exploited bugs

Not rated. No reviewed zero-days yet.

Fixing privately reported bugs

73 range 61–84rank 12 of 20

Provisional 18 private reports, published on 12 dates. Not enough yet for a firm grade.

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work

Embed this report card

Why these grades

Every clock starts at the first public report.

  • Response to exploited bugs: not rated. No reviewed exploited zero-days in the last 36 months, so this grade does not apply yet.
  • Fixing privately reported bugs: B- (73), provisional. Median 132 days from private report to fix (18 cases, 2 with a vendor fix date). 9 of 18 took longer than ZDI's 120-day deadline. 9 of 18 concern Access Rights Manager.
  • 3 of 3 reviewed exploited bugs had a public fix before exploitation was reported. They do not count toward the response grade. For one of them, fixes for every version came later, up to 6 days.

Response to exploited bugs: sub-scores

  • Time to first advisoryNo reviewed zero-days in the last 36 months
    NR
    0 cases, not used
  • Time to first fixNo reviewed zero-days in the last 36 months
    NR
    0 cases, not used
  • Time to fix all versionsNo reviewed zero-days in the last 36 months
    NR
    0 cases, not used
  • OpennessAdvisories available by RSS
    62
    3 cases, low confidence, not used for this vendor

Fixing privately reported bugs: sub-score

  • Private fix speedMedian 132 days from private report to fix (18 cases, 2 with a vendor fix date)
    73B−
    18 cases, low confidence, weight 100%

Response fingerprint

Compressed time scale

Counts toward the response grade 0

No incidents count toward the grade yet.

Not graded 3: n-days, unreviewed timelines and end-of-life products
  1. 3 Jun 2026SolarWinds Serv-U Unauthenticated Denial of Service VulnerabilityNot graded: n-day
  2. 28 Jan 2026SolarWinds Web Help Desk deserialization RCE and security control bypass (WHD 2026.1)Not graded: unclear
  3. 17 Sep 2025SolarWinds Web Help Desk AjaxProxy Deserialization of Untrusted Data Remote Code Execution VulnerabilityNot graded: n-day
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Open, no fix
  • Open, partly fixed
  • Fixed when disclosed
  • Date only, no time of day

One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.

Exploited incidents

3 in 24 months, 1 with known ransomware use, 0% exploited before a fix

First reportIncidentCVSSSilenceFirst fixAll fixedStatusGrade
3 Jun 2026SolarWinds Serv-U Unauthenticated Denial of Service VulnerabilityCVE-2026-283187.5same day1d1dFixedNot graded: n-day
28 Jan 2026SolarWinds Web Help Desk deserialization RCE and security control bypass (WHD 2026.1)CVE-2025-40551, CVE-2025-405369.8same daysame daysame dayFixedNot graded: unclear
17 Sep 2025SolarWinds Web Help Desk AjaxProxy Deserialization of Untrusted Data Remote Code Execution VulnerabilityCVE-2025-263999.8same day6d6dFixedNot graded: n-day

Private reports

Median 132 days, 50% over 120 days, 0 published unpatched

Bugs reported privately to SolarWinds by ZDI or Project Zero.

One tick per graded report. Counts to the vendor's fix when its date is known, else to publication. Taller ticks were published before a fix existed.
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
23 Sep 2025ZDI-25-906CVE-2025-26399Web Help Desk22to vendor fix, 17 Sep 2025Yes
29 Jul 2025ZDI-25-710CVE-2024-45710Platform369to publicationYes
28 Jul 2025ZDI-25-654CVE-2025-26397TFTP Server87to publicationYes
17 Jun 2025ZDI-25-407CVE-2024-28988Web Help Desk280to publicationYes
17 Jun 2025ZDI-25-406CVE-2024-45711Serv-U286to publicationYes
2 Jun 2025ZDI-25-320CVE-2025-26396DameWare Mini Remote Control90to publicationYes
3 Mar 2025ZDI-25-104CVE-2024-52606Platform103to vendor fix, 11 Feb 2025Yes
13 Sep 2024ZDI-24-1224, ZDI-24-1225CVE-2024-28990, CVE-2024-28991Access Rights Manager112to publicationYes
29 Jul 2024ZDI-24-905, ZDI-24-1020CVE-2024-28992Access Rights Manager151to publicationYes
18 Jul 2024ZDI-24-906CVE-2024-28074Access Rights Manager177to publicationYes
Show all 18 private reports
PublishedAdvisoryProductDays from report to fix or to publication. Tick: ZDI's 120-day deadline.Patch at publication
18 Jul 2024ZDI-24-215, ZDI-24-907, ZDI-24-908, ZDI-24-909, ZDI-24-910, ZDI-24-911CVE-2024-0692, CVE-2024-23465, CVE-2024-23466, CVE-2024-23467, CVE-2024-23470, CVE-2024-23471Security Event Manager; Access Rights Manager183to publicationYes
18 Jul 2024ZDI-24-454, ZDI-24-912, ZDI-24-913, ZDI-24-914, ZDI-24-915, ZDI-24-916CVE-2024-23468, CVE-2024-23469, CVE-2024-23472, CVE-2024-23473, CVE-2024-23474, CVE-2024-23475Access Rights Manager188to publicationYes
15 May 2024ZDI-24-455CVE-2024-28075Access Rights Manager82to publicationYes
28 Mar 2024ZDI-24-348CVE-2024-23477Access Rights Manager96to publicationYes
28 Mar 2024ZDI-24-349, ZDI-24-351CVE-2024-23476, CVE-2024-23479Access Rights Manager97to publicationYes
28 Mar 2024ZDI-24-008, ZDI-24-350CVE-2023-40057, CVE-2023-40058Access Rights Manager113to publicationYes
28 Mar 2024ZDI-24-347CVE-2024-23478Access Rights Manager161to publicationYes
15 Feb 2024ZDI-24-170, ZDI-24-171CVE-2023-35188, CVE-2023-50395Orion Platform190to publicationYes

Grade history

Response to exploited bugs: score at the end of each month.

Not rated at any point in this period.

Channels

Get SolarWinds's own alerts

What we watch

  • RSSSolarWinds Trust Center security advisories RSS

See sources and health for when each was last read.