Solarwinds Web Help Desk — known CVE vulnerabilities

Every CVE whose affected-product data names Solarwinds Web Help Desk, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (21)

• CVE-2025-26399 — CVSS 9.8 (critical) — actively exploited: SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability…
• CVE-2025-40552 — CVSS 9.8 (critical): SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious…
• CVE-2025-40551 — CVSS 9.8 (critical) — actively exploited: SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code…
• CVE-2024-28986 — CVSS 9.8 (critical) — actively exploited: SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited…
• CVE-2024-28988 — CVSS 9.8 (critical): SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited…
• CVE-2025-40554 — CVSS 9.8 (critical): SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker…
• CVE-2025-40553 — CVSS 9.8 (critical): SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code…
• CVE-2024-28987 — CVSS 9.1 (critical) — actively exploited: The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to…
• CVE-2026-28299 — CVSS 8.2 (high): SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk…
• CVE-2025-40536 — CVSS 8.1 (high) — actively exploited: SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an…
• CVE-2025-40537 — CVSS 7.5 (high): SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow…
• CVE-2024-28989 — CVSS 5.5 (medium): SolarWinds Web Help Desk was found to have a hardcoded cryptographic key that could allow the disclosure of sensitive information from the…
• CVE-2019-16954 — CVSS 5.4 (medium): SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket.
• CVE-2019-16961 — CVSS 5.4 (medium): SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name.
• CVE-2019-16960 — CVSS 5.4 (medium): SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field.
• CVE-2019-16956 — CVSS 5.4 (medium): SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket.
• CVE-2021-32076 — CVSS 5.3 (medium): Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk…
• CVE-2021-35243 — CVSS 5.3 (medium): The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP…
• CVE-2025-26400 — CVSS 5.3 (medium): SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information…
• CVE-2021-35251 — CVSS 5.3 (medium): Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental…
• CVE-2024-45709 — CVSS 5.3 (medium): SolarWinds Web Help Desk was susceptible to a local file read vulnerability. This vulnerability requires the software be installed on Linux…