WH
Product
Web Help Desk
On CISA KEVExploited in the wildRansomware-linked
22
CVEs
5
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 3Medium 9Low 0
Watch
Add Web Help Desk to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-40551 In wildKEV | 9.8 | Jan 28 | SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability Affected: 12.8.8 HF1 and below |
| CVE-2025-40536 In wildKEV | 9.8 | Jan 28 | SolarWinds Web Help Desk Security Control Bypass Vulnerability Affected: 12.8.8 HF1 and below |
| CVE-2025-26399 RansomwareIn wildKEV | 9.8 | Sep 23 | SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability Affected: 12.8.7 and below |
| CVE-2024-28986 In wildKEV | 9.8 | Aug 13 | SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability Affected: previous versions through 12.8.3 |
| CVE-2024-28987 In wildKEV | 9.1 | Aug 21 | SolarWinds Web Help Desk Hardcoded Credential Vulnerability Affected: 12.8.3 Hotfix 1 and previous versions |
| CVE-2026-28323 | 9.8 | Jul 30 | SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability Affected: 2026.1 and all previous versions |
| CVE-2025-40554 | 9.8 | Jan 28 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web… Affected: before 2026.1 |
| CVE-2025-40553 | 9.8 | Jan 28 | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to… Affected: before 2026.1 |
| CVE-2025-40552 | 9.8 | Jan 28 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that… Affected: before 2026.1 |
| CVE-2024-28988 | 9.8 | Sep 1 | SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on… Affected: through 12.8.2; 12.8.3; 12.8.3; 12.8.3 |
| CVE-2026-28299 | 7.5 | Jun 2 | SolarWinds Web Help Desk Denial-of-Service Vulnerability Affected: 2026.1 and all previous versions |
| CVE-2025-40537 | 7.5 | Jan 28 | SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administrative functions Affected: before 2026.1 |
| CVE-2021-35243 | 7.5 | Dec 23 | The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to execute dangerous HTTP requests Affected: through 12.7.7 |
| CVE-2025-26400 | 6.5 | Jul 29 | SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information disclosure Affected: before 12.8.7 |
| CVE-2024-28989 | 5.5 | Feb 11 | SolarWinds Web Help Desk was found to have a hardcoded cryptographic key that could allow the disclosure of sensitive information from the software Affected: before 12.8.5 |
| CVE-2024-45709 | 5.5 | Dec 10 | SolarWinds Web Help Desk was susceptible to a local file read vulnerability Affected: before 12.8.4 |
| CVE-2019-16961 | 5.4 | Jan 15 | SolarWinds Web Help Desk 12.7.0 allows XSS via a Schedule Name Affected: 12.7.0 |
| CVE-2019-16954 | 5.4 | Jan 6 | SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket Affected: 12.7.0 |
| CVE-2019-16960 | 5.4 | Jan 4 | SolarWinds Web Help Desk 12.7.0 allows XSS via a CSV template file with a crafted Location Name field Affected: 12.7.0 |
| CVE-2019-16956 | 5.4 | Jan 4 | SolarWinds Web Help Desk 12.7.0 allows XSS via the Request Type parameter of a ticket Affected: 12.7.0 |
| CVE-2021-35251 | 5.3 | Mar 10 | Sensitive information could be displayed when a detailed technical error message is posted Affected: before 12.7.8 |
| CVE-2021-32076 | 5.3 | Aug 26 | Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2 Affected: through 12.7.2 |
Showing 22