Advisories · Technology

SolarWinds Web Help Desk.

Every CVE that names SolarWinds Web Help Desk among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-28323 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability
- SolarWinds Web Help Desk
- Authentication bypass
Not analysed yet 30 Jul 2026
CVE-2026-28299 CVE record

CVSS 8.2 High

SolarWinds Web Help Desk Denial-of-Service Vulnerability
- SolarWinds Web Help Desk
- Denial of service
Not analysed yet 2 Jun 2026
CVE-2025-40554 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

SolarWinds Web Help Desk Authentication Bypass Vulnerability
- SolarWinds Web Help Desk
- Authentication bypass
Not analysed yet 28 Jan 2026
CVE-2025-40553 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
- SolarWinds Web Help Desk
- Insecure deserialization
Not analysed yet 28 Jan 2026
CVE-2025-40552 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

SolarWinds Web Help Desk Authentication Bypass Vulnerability
- SolarWinds Web Help Desk
- Authentication bypass
Not analysed yet 28 Jan 2026
CVE-2025-40551 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
- SolarWinds Web Help Desk
- Insecure deserialization
Not analysed yet 28 Jan 2026
CVE-2025-40537 CVE record

CVSS 7.5 High

SolarWinds Web Help Desk Hardcoded Credentials Vulnerability
- SolarWinds Web Help Desk
- Hard-coded credentials
Not analysed yet 28 Jan 2026
CVE-2025-40536 CVE record

CVSS 8.1 HighCritical · KEV, CVSS 7+ and EPSSKEV

SolarWinds Web Help Desk Security Control Bypass Vulnerability
- SolarWinds Web Help Desk
- CWE-693
Not analysed yet 28 Jan 2026
CVE-2025-26399 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability
- SolarWinds Web Help Desk
- Insecure deserialization
Not analysed yet 23 Sept 2025
CVE-2024-28988 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability
- SolarWinds Web Help Desk
- Insecure deserialization
Not analysed yet 1 Sept 2025
CVE-2025-26400 CVE record

CVSS 5.3 Medium

SolarWinds Web Help Desk XML External Entity Injection (XXE) Vulnerability
- SolarWinds Web Help Desk
- XML external entities (XXE)
Not analysed yet 29 Jul 2025
CVE-2024-28989 CVE record

CVSS 5.5 Medium

SolarWinds Web Help Desk Cryptographic Key Management Vulnerability
- SolarWinds Web Help Desk
- Hard-coded credentials
Not analysed yet 11 Feb 2025
CVE-2024-45709 CVE record

CVSS 5.3 Medium

SolarWinds Web Help Desk Local File Read Vulnerability
- SolarWinds Web Help Desk
- Path traversal
Not analysed yet 10 Dec 2024
CVE-2024-28987 CVE record

CVSS 9.1 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

SolarWinds Web Help Desk Hardcoded Credential Vulnerability
- SolarWinds Web Help Desk
- Hard-coded credentials
Not analysed yet 21 Aug 2024
CVE-2024-28986 CVE record

CVSS 9.8 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV

SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability
- SolarWinds Web Help Desk
- Insecure deserialization
Not analysed yet 13 Aug 2024
CVE-2021-35251 CVE record

CVSS 5.3 Medium

Sensitive Data Disclosure Vulnerability
- SolarWinds Web Help Desk
- Information disclosure
Not analysed yet 9 Mar 2022
CVE-2021-35232 CVE record

CVSS 6.8 Medium

Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries
- SolarWinds Web Help Desk
- Hard-coded credentials
Not analysed yet 27 Dec 2021
CVE-2021-35243 CVE record

CVSS 5.3 Medium

HTTP PUT & DELETE Methods Enabled
- SolarWinds Web Help Desk
- CWE-749
Not analysed yet 23 Dec 2021
CVE-2021-32076 CVE record

CVSS 5.3 Medium

Access Restriction bypass vulnerability via referrer spoof - Business Logic Bypass
- SolarWinds Web Help Desk
- Authentication bypass
Not analysed yet 26 Aug 2021