SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.

SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is required.

SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges.

SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.

SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations.

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.

SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges.

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode.

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected.

SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.

SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled.

SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations.

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in Windows deployments.

SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from an administrator account.

SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as root. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.

SolarWinds Database Performance Analyzer was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.

A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website.

Hello all! Since the post last week seemed to be helpful to some folks, I figured I'd make another post this week.

The big, bad, scary one is the Netlogon RCE because it targets domain controllers and is now confirmed exploited. After that, I’d be looking at Palo Alto GlobalProtect, SolarWinds Serv-U, Cisco SD-WAN Manager, and any Linux container hosts that might still be exposed to the old cgroups v1 escape.

Here's the order I’d work them:

1. CVE-2026-41089: Microsoft Windows Netlogon

Stack-based buffer overflow in Netlogon. An unauthenticated attacker can hit a domain controller over the network and get code execution.

Affected: Windows Server 2012 R2 through 2025.

Why it matters: CVSS 9.8. Active exploitation has been confirmed by Belgium’s CCB.

Action: If your DCs got May’s cumulative update, you should be covered. If you deferred May updates on domain controllers, I’d move this to the top of the queue. Find your rollup patches here for your Server version.

2. CVE-2026-0257: Palo Alto Networks PAN-OS GlobalProtect

Authentication bypass in the GlobalProtect portal and gateway. The short version is that forged cookies can give an attacker an unauthorized VPN session.

Affected: PAN-OS firewalls with a GlobalProtect portal or gateway where authentication override cookies are enabled.

Why it matters: CVSS 9.1. Exploited in the wild and on CISA KEV.

Action: Patch to a fixed PAN-OS release. If you can’t patch immediately, disable authentication override or use a dedicated certificate only for that feature.

3. CVE-2026-28318: SolarWinds Serv-U

Unauthenticated denial of service. A crafted POST request with a Content-Encoding: deflate header can crash the Serv-U service.

Affected: Serv-U file transfer versions before 15.5.4, and 15.5.4 without Hotfix 1.

Why it matters: CVSS 7.5. Exploited in the wild. Added to CISA KEV on June 5 with a federal deadline of June 19.

Action: Update to Serv-U 15.5.4 Hotfix 1. If you need an interim move, restrict access to known IPs and block POST requests carrying a Content-Encoding header.

4. CVE-2026-20245: Cisco Catalyst SD-WAN Manager

Command injection in Cisco Catalyst SD-WAN Manager. A crafted file upload can run arbitrary commands as root.

Affected: Cisco Catalyst SD-WAN Manager, formerly vManage.

Why it matters: CVSS 7.8. Exploited as a zero-day. No patch available yet.

Action: This one does require netadmin privileges, so it is not the same kind of emergency as an unauthenticated internet-facing RCE. But with no fix available, I’d still lock down who can reach SD-WAN Manager, audit netadmin accounts, make sure MFA is solid, and watch Cisco’s advisory for the patch. You can see Cisco's additional recommendations here.

5. CVE-2022-0492: Linux kernel cgroups v1 container escape

Old bug, but newly relevant again because CISA added it to KEV last week. The cgroups v1 releaseagent issue can let a low-privileged local user escape a container and escalate to root.

Affected: Linux hosts running containers on unpatched kernels or with overly permissive container configs.

Why it matters: CVSS 7.8. Added to CISA KEV on June 2 based on evidence of active exploitation.

Action: Check your container hosts. Make sure kernels are patched, containers are not running with CAPSYSADMIN, and AppArmor/SELinux/Seccomp profiles are actually enforced.

Three of these are on CISA KEV: Palo Alto, Serv-U, and the Linux cgroups bug.

If I only had time to clear one, I’d start with Netlogon. Unauthenticated RCE against domain controllers is not something I’d want sitting around, especially now that exploitation has been confirmed.

Serv-U would be next if it is internet-facing, then Palo Alto GlobalProtect if authentication override is enabled.

Also worth noting: Check Point Remote Access VPN CVE-2026-50751 and LiteLLM CVE-2026-42271 both landed on KEV after this window, so they’ll probably be in next week’s batch.

If you like the format, please consider checking out my newsletter! Link is on my profile page.

https://www.helpnetsecurity.com/2026/06/08/cisa-patch-actively-exploited-solarwinds-serv-u-dos-vulnerability-cve-2026-28318/