Solarwinds Web Help Desk
22 CVEs affecting Solarwinds Web Help Desk. Latest disclosed: 2026-07-30. Critical: 9, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-28323 | Critical | 9.8 | 2026-07-30 | SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled. |
CVE-2025-40554 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific a… |
CVE-2025-40553 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would a… |
CVE-2025-40552 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute acti… |
CVE-2025-40551 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would a… |
CVE-2025-26399 | Critical | 9.8 | 2025-09-23 | SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, wo… |
CVE-2024-28988 | Critical | 9.8 | 2025-09-01 | SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker… |
CVE-2024-28986 | Critical | 9.8 | 2024-08-13 | SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker… |
CVE-2024-28987 | Critical | 9.1 | 2024-08-21 | The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functi… |
CVE-2026-28299 | High | 8.2 | 2026-06-02 | SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due… |
CVE-2025-40536 | High | 8.1 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to g… |
CVE-2025-40537 | High | 7.5 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administrat… |
CVE-2024-28989 | Medium | 5.5 | 2025-02-11 | SolarWinds Web Help Desk was found to have a hardcoded cryptographic key that could allow the disclosure of sensitive information from the software. |
CVE-2019-16961 | Medium | 5.4 | 2021-01-15 | SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name. |
CVE-2019-16954 | Medium | 5.4 | 2021-01-06 | SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket. |
CVE-2019-16960 | Medium | 5.4 | 2021-01-04 | SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field. |
CVE-2019-16956 | Medium | 5.4 | 2021-01-04 | SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket. |
CVE-2025-26400 | Medium | 5.3 | 2025-07-29 | SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information disclosure. A valid… |
CVE-2024-45709 | Medium | 5.3 | 2024-12-10 | SolarWinds Web Help Desk was susceptible to a local file read vulnerability. This vulnerability requires the software be installed on Linux and configured to… |
CVE-2021-35251 | Medium | 5.3 | 2022-03-10 | Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details about the Web… |