Dear Customer,


You are receiving this email because you are a customer who owns SolarWinds products that we believe, based on our investigations to date, are NOT AFFECTED by the vulnerability in our Orion Platform products identified in our public statements and recent news reports.


We have been made aware of a cyberattack to our systems that inserted a vulnerability within our SolarWinds® Orion® Platform software builds for versions 2019.4 HF 5, 2020.2 with no hotfix, and 2020.2 HF 1 only. We have been advised that this incident was likely the result of a highly sophisticated, targeted, and manual supply chain attack by an outside nation state, but we have not independently verified the identity of the attacker. 

We have scanned the code of all of our software products for markers similar to those used in the attack on our Orion Platform products identified above, and we have found no evidence that other versions of our Orion Platform products or our other products contain those markers. As such, we are not aware that other versions of Orion Platform products have been impacted by this security vulnerability. Other non-Orion Platform products are also not known by us to be impacted by this security vulnerability. 

If you aren’t sure which version of the Orion Platform products you are using, see directions on how to check that here. To check which hotfix updates you have applied, please go here.

Products believed to be NOT AFFECTED by this security vulnerability are:
8Man
Access Rights Manager (ARM)
AppOptics
Backup Document
Backup Profiler
Backup Profiler
Backup Server
Backup Workstation
CatTools
Dameware Mini Remote Control
Dameware Patch Manager
Dameware Remote Everywhere
Dameware Remote Manager
Database Performance Analyzer (DPA)
Database Performance Monitor (DPM)
DNSstuff
Engineer’s Toolset
Engineer's Web Toolset
FailOver Engine
Firewall Security Monitor
Identity Monitor
ipMonitor
Kiwi CatTools
Kiwi Syslog Server
LANSurveyor
Librato
Log & Event Manager (LEM)
Log & Event Manager Workstation Edition 
Loggly
Mobile Admin
Network Topology Mapper (NTM)
Papertrail
Patch Manager  
Pingdom
Pingdom Server Monitor
Security Event Manager (SEM)
Security Event Manager Workstation Edition
Server Configuration Monitor (SCM)
Server Profiler
Service Desk
Serv-U FTP Server
Serv-U Gateway
Serv-U MFT Server
Storage Manager
Storage Profiler
Threat Monitor 
Virtualization Profiler
Web Help Desk    
SQL Sentry 
DB Sentry
V Sentry
Win Sentry
BI Sentry 
SentryOne Document 
SentryOne Test
Task Factory
DBA xPress (Free)
Plan Explorer (Fee)
APS Sentry (EOL)
DW Sentry (EOL)
SQL Sentry Essentials (EOL)
SentryOne Monitor (EOL)
BI xPress (EOL)
 
At this time, we are not aware of an impact to our SolarWinds MSP products, including RMM and N-central. Additionally, we are not aware of any SolarWinds free tools or any of our agents that were affected by this vulnerability.

Our investigations and remediation efforts for these matters are still ongoing, and we will continue to update the Security Advisory page on our website as more information becomes available to us throughout our investigations.  

Visit www.solarwinds.com/securityadvisory for more detailed information.


We also encourage you to review the Form 8-K that we filed this morning with the SEC. You can find this filing on the investor relations page of our website and on the SEC’s website.


Security and trust in our software are the foundation of our commitment to our customers. Thank you for your continued patience and partnership as we continue to work through this issue.


Sincerely,

Kevin Thompson
President & CEO
SolarWinds, Inc