What is CVE-2025-26400?

CVE-2025-26400 is a medium-severity vulnerability in Solarwinds Web Help Desk, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 5.3/10. Published 2025-07-29.

How severe is CVE-2025-26400?

Medium severity. CVSS v3 base score is 5.3 out of 10.

XXE in Solarwinds Web Help Desk

CVE-2025-26400

SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local s…

Vulnerability class: XXE (XML External Entity)

EPSS: 0.000 (7.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Solarwinds Web Help Desk — versions 12.8.6 and previous versions

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

Frequently asked questions

What is CVE-2025-26400?: CVE-2025-26400 is a medium-severity vulnerability in Solarwinds Web Help Desk, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 5.3/10. Published 2025-07-29.
How severe is CVE-2025-26400?: Medium severity. CVSS v3 base score is 5.3 out of 10.