Skip to content

RadicalNotion.AI

We do not sell or share your personal information

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Report Cards
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0

Platform

My Vulnerabilities
Insights
Notifications
Account
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Book a demo

Get Started

Sign up
Log in

Legal

Privacy
Terms

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Log in

Home
Vendors
Solarwinds
Orion Platform

solarwinds orion platform Vulnerabilities: CVEs, CISA KEV & Security Advisories

51 CVEs

1 in CISA KEV

solarwinds orion platform Vulnerabilities

CVE security advisories and vulnerability history for orion platform by solarwinds.

51

Total CVEs

Published

1

In CISA KEV

Exploited in the wild

2

Public exploits

With known exploit

7.5

Avg CVSS

2019–2023

Last updated September 13, 2023

Overview

solarwinds orion platform has 51 published CVE records since 2019, of which 1 are in CISA's Known Exploited Vulnerabilities catalog and 2 have a known public exploit. The average CVSS base score across scored CVEs is 7.5.

This page aggregates every publicly disclosed vulnerability (CVE) affecting solarwinds orion platform, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list. Affected platforms include Windows.

Severity and exploitation

How the CVSS severity of solarwinds orion platform's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical2

High27

Medium11

Low0

11 additional CVEs have no CVSS severity score.

In CISA’s Known Exploited Vulnerabilities catalog

1

One of solarwinds orion platform's CVEs is confirmed exploited in the wild.

Public exploits

2

2 of solarwinds orion platform's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every solarwinds orion platform version named in a CVE, then pick one to see only the CVEs that affect it.

Specific versions

2019.4 HF 51 CVE
2020.2 HF 11 CVE
2020.2 without hotfix1 CVE

Fixed in

2020.2.616 CVEs
2020.2.6 HF14 CVEs
> 2020.2.6 HF13 CVEs
> 2020.2.6 HF53 CVEs
> 2020.2.6 HF5 and prior versions3 CVEs
2020.2.53 CVEs
2023.23 CVEs
2020.2.42 CVEs
2023.3.12 CVEs
2018.41 CVE
2020.2.11 CVE
2020.2.5 HF11 CVE
2020.2.6 HF 31 CVE
2022.2.31 CVE
2022.3.01 CVE

Find a version

51 CVEs

Sort

SolarWinds Platform Exposed Dangerous Method Vulnerability
CVE-2023-23845
Patch
CWE-697
Medium · CVSS 6.8
EPSS 0.3% (53th pct)2023-09-13
SolarWinds Platform Exposed Dangerous Method Vulnerability
CVE-2023-23840
Patch
CWE-697
Medium · CVSS 6.8
EPSS 0.3% (53th pct)2023-09-13
SolarWinds Platform Incorrect Input Neutralization Vulnerability
CVE-2022-47509
Patch
CWE-79
Medium · CVSS 6.1
EPSS 3.4% (88th pct)2023-04-21
High vulnerability · 2023-04-21
CVE-2022-47505
Patch
CWE-269
High · CVSS 7.8
EPSS 0.3% (52th pct)2023-04-21
High vulnerability · 2023-04-21
CVE-2022-36963
Patch
CWE-94
High · CVSS 7.2
EPSS 4.8% (90th pct)2023-04-21
High vulnerability · 2023-02-15
CVE-2023-23836
Patch
CWE-502
High · CVSS 7.2
EPSS 67.2% (99th pct)2023-02-15
SolarWinds Platform Deserialization of Untrusted Data Vulnerability
CVE-2022-47507
Patch
CWE-502
High · CVSS 7.2
EPSS 11.3% (94th pct)2023-02-15
High vulnerability · 2023-02-15
CVE-2022-47506
Patch
CWE-22
High · CVSS 7.8
EPSS 0.1% (32th pct)2023-02-15
SolarWinds Platform Deserialization of Untrusted Data Vulnerability
CVE-2022-47504
Patch
CWE-502
High · CVSS 7.2
EPSS 6.8% (91th pct)2023-02-15
High vulnerability · 2023-02-15
CVE-2022-47503
Patch
CWE-502
High · CVSS 7.2
EPSS 11.3% (94th pct)2023-02-15
High vulnerability · 2023-02-15
CVE-2022-38111
Patch
CWE-502
High · CVSS 7.2
EPSS 17.2% (95th pct)2023-02-15
High vulnerability · 2022-11-29
CVE-2022-36964
Patch
CWE-502
High · CVSS 8.8
EPSS 2.8% (86th pct)2022-11-29
High vulnerability · 2022-11-29
CVE-2022-36962
Patch
CWE-78
High · CVSS 7.2
EPSS 1.7% (83th pct)2022-11-29
High vulnerability · 2022-11-29
CVE-2022-36960
Patch
CWE-287
High · CVSS 8.8
EPSS 0.3% (50th pct)2022-11-29
High vulnerability · 2022-10-20
CVE-2022-38108
Public exploit
Patch
Workaround
CWE-502
High · CVSS 7.2
EPSS 88.6% (100th pct)2022-10-20
High vulnerability · 2022-10-20
CVE-2022-36958
Patch
Workaround
CWE-502
High · CVSS 8.8
EPSS 14.8% (95th pct)2022-10-20
High vulnerability · 2022-10-20
CVE-2022-36957
Patch
Workaround
CWE-502
High · CVSS 7.2
EPSS 2.2% (85th pct)2022-10-20
Medium vulnerability · 2022-10-20
CVE-2022-36966
Patch
CWE-639
Medium · CVSS 5.4
EPSS 0.3% (55th pct)2022-10-20
Medium vulnerability · 2022-09-30
CVE-2022-36965
Patch
CWE-79
Medium · CVSS 6.1
EPSS 2.6% (86th pct)2022-09-30
High vulnerability · 2022-09-30
CVE-2022-36961
Patch
CWE-89
High · CVSS 8.8
EPSS 11.8% (94th pct)2022-09-30
High vulnerability · 2021-12-20
CVE-2021-35234
Patch
Workaround
CWE-89
High · CVSS 8.0
EPSS 0.8% (75th pct)2021-12-20
Medium vulnerability · 2021-12-20
CVE-2021-35244
Patch
Workaround
Medium · CVSS 6.8
EPSS 34.9% (97th pct)2021-12-20
Medium vulnerability · 2021-12-20
CVE-2021-35248
Patch
Workaround
CWE-732
Medium · CVSS 6.8
EPSS 0.3% (51th pct)2021-12-20
Insecure Deserialization of untrusted data causing Remote code execution vulnerability.
CVE-2021-35217
Patch
High · CVSS 8.9
EPSS 60.1% (98th pct)2021-09-08
High vulnerability · 2021-09-01
CVE-2021-35218
Patch
CWE-502
High · CVSS 8.9
EPSS 14.9% (95th pct)2021-09-01
High vulnerability · 2021-09-01
CVE-2021-35215
Patch
CWE-502
High · CVSS 8.9
EPSS 82.8% (99th pct)2021-09-01
Medium vulnerability · 2021-09-01
CVE-2021-35238
Patch
CWE-79
Medium · CVSS 4.8
EPSS 0.5% (67th pct)2021-09-01
High vulnerability · 2021-08-31
CVE-2021-35212
Patch
High · CVSS 8.9
EPSS 2.1% (84th pct)2021-08-31
Orion User setting Improper Access Control Privilege Escalation Vulnerability
CVE-2021-35213
Patch
CWE-284
High · CVSS 8.9
EPSS 0.9% (76th pct)2021-08-31
Medium vulnerability · 2021-08-31
CVE-2021-35240
Patch
Workaround
CWE-79
Medium · CVSS 6.5
EPSS 0.4% (61th pct)2021-08-31

Showing 30 of 51

Common weakness types

The CWE weakness categories most often found in solarwinds orion platform CVEs. Follow any weakness for its full explanation.

CWE-502Deserialization of Untrusted Data12 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')6 CVEs
CWE-284Improper Access Control3 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3 CVEs
CWE-697Incorrect Comparison2 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')2 CVEs
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')1 CVE
CWE-94Improper Control of Generation of Code ('Code Injection')1 CVE

Disclosure activity by year

How many solarwinds orion platform CVEs were published each year.

2019

1

2020

6

2021

24

2022

9

2023

11

Other solarwinds products

Browse vulnerabilities for other products by solarwinds.

SolarWinds Platform44 CVEs serv-u40 CVEs access rights manager32 CVEs access_rights_manager23 CVEs Web Help Desk22 CVEs serv-u file server21 CVEs serv-u ftp server12 CVEs database performance analyzer10 CVEs

All solarwinds vulnerabilities

Frequently asked questions

Common questions about solarwinds orion platform vulnerabilities.

How many CVEs does solarwinds orion platform have?

solarwinds orion platform has 51 published CVE records since 2019.

How many solarwinds orion platform CVEs are in CISA KEV?

Yes — 1 of solarwinds orion platform's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Are there public exploits for solarwinds orion platform vulnerabilities?

Yes — 2 of solarwinds orion platform's CVEs have a known public exploit.

Which versions of solarwinds orion platform are affected?

18 distinct solarwinds orion platform versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in solarwinds orion platform CVEs?

solarwinds orion platform's CVEs most often map to these CWE weakness types: CWE-502 (Deserialization of Untrusted Data), CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-284 (Improper Access Control), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

How many critical solarwinds orion platform vulnerabilities are there?

solarwinds orion platform has 2 critical and 27 high-severity CVEs.

What is the average severity of solarwinds orion platform CVEs?

The average CVSS base score across solarwinds orion platform's scored CVEs is 7.5.

References

All solarwinds vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track solarwinds orion platform vulnerabilities

Monitor new solarwinds orion platform vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References