Skip to content

RadicalNotion.AI

We do not sell or share your personal information

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Report Cards
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder
Developer API

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Careers
Contact
Book a demo

Get Started

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Log in

Log in Start free

Home
Vendors
Solarwinds
Web Help Desk

SolarWinds Web Help Desk Vulnerabilities: CVEs, CISA KEV & Security Advisories

22 CVEs

5 in CISA KEV

SolarWinds Web Help Desk Vulnerabilities

CVE security advisories and vulnerability history for Web Help Desk by SolarWinds.

22

Total CVEs

Published

5

In CISA KEV

Exploited in the wild

8

Public exploits

PoC or exploit code

7.5

Avg CVSS

2021–2026

Last updated June 2, 2026

Overview

SolarWinds Web Help Desk has 22 published CVE records since 2021, of which 5 are in CISA's Known Exploited Vulnerabilities catalog and 8 have a known public exploit. The average CVSS base score across scored CVEs is 7.5.

This page aggregates every publicly disclosed vulnerability (CVE) affecting SolarWinds Web Help Desk, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list. Affected platforms include linux.

Severity and exploitation

How the CVSS severity of SolarWinds Web Help Desk's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical9

High3

Medium10

Low0

In CISA’s Known Exploited Vulnerabilities catalog

5

5 of SolarWinds Web Help Desk's CVEs are confirmed exploited in the wild.

Public exploits

8

8 of SolarWinds Web Help Desk's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every SolarWinds Web Help Desk version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 2026.16 CVEs
>= 12.8.8 HF1 and below6 CVEs
12.7.0 <= v <= 12.7.04 CVEs
12.8.3 <= v <= 12.8.33 CVEs
<= 12.8.22 CVEs
< 12.7.81 CVE
< 12.8.31 CVE
< 12.8.41 CVE
< 12.8.51 CVE
< 12.8.71 CVE
< 2026.21 CVE
<= 12.7.21 CVE
<= 12.7.51 CVE
<= 12.7.71 CVE
<= 12.8.61 CVE
>= 12.8.3 HF 2 and previous versions1 CVE
>= 12.8.3 HF3 and previous versions1 CVE
>= 12.8.3 Hotfix 1 and previous versions1 CVE
>= 12.8.4 and previous versions1 CVE
>= 12.8.6 and previous versions1 CVE
>= 12.8.7 and below1 CVE
>= 2026.1 and all previous versions1 CVE
12.8.7 <= v <= 12.8.71 CVE
previous versions <= v <= 12.8.31 CVE

Fixed in

2026.16 CVEs
> 12.7.51 CVE
> 12.8.31 CVE
12.7.7 HF 11 CVE
12.7.81 CVE
12.8.31 CVE
12.8.41 CVE
12.8.51 CVE
12.8.71 CVE
2026.21 CVE

Find a version

22 CVEs

Sort

SolarWinds Web Help Desk Denial-of-Service Vulnerability
CVE-2026-28299
Patch
CWE-770
High · CVSS 8.2
EPSS 0.4% (36th pct)2026-06-02
SolarWinds Web Help Desk Authentication Bypass Vulnerability
CVE-2025-40554
Public exploit
Patch
CWE-1390
Critical · CVSS 9.8
EPSS 57.3% (99th pct)2026-01-28
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
CVE-2025-40553
Public exploit
Patch
CWE-502
Critical · CVSS 9.8
EPSS 60.4% (99th pct)2026-01-28
SolarWinds Web Help Desk Authentication Bypass Vulnerability
CVE-2025-40552
Public exploit
Patch
CWE-1390
Critical · CVSS 9.8
EPSS 49.7% (99th pct)2026-01-28
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
CVE-2025-40551
CISA KEV
Public exploit
Patch
CWE-502
Added to CISA KEV 2026-02-03
Critical · CVSS 9.3
EPSS 83.6% (100th pct)2026-01-28
SolarWinds Web Help Desk Hardcoded Credentials Vulnerability
CVE-2025-40537
Patch
CWE-798
High · CVSS 7.5
EPSS 0.5% (42th pct)2026-01-28
SolarWinds Web Help Desk Security Control Bypass Vulnerability
CVE-2025-40536
CISA KEV
Public exploit
Patch
CWE-693
Added to CISA KEV 2026-02-12
Critical · CVSS 9.2
EPSS 71.5% (99th pct)2026-01-28
SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability
CVE-2025-26399
CISA KEV
Public exploit
Patch
CWE-502
Added to CISA KEV 2026-03-09
Critical · CVSS 10.0
EPSS 88.3% (100th pct)2025-09-23
SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability
CVE-2024-28988
Patch
CWE-502
Critical · CVSS 9.8
EPSS 36.6% (98th pct)2025-09-01
SolarWinds Web Help Desk XML External Entity Injection (XXE) Vulnerability
CVE-2025-26400
Patch
CWE-611
Medium · CVSS 6.5
EPSS 0.3% (18th pct)2025-07-29
Medium vulnerability · 2025-02-11
CVE-2024-28989
Patch
CWE-321
Medium · CVSS 5.5
EPSS 0.3% (20th pct)2025-02-11
Medium vulnerability · 2024-12-10
CVE-2024-45709
Patch
CWE-22
Medium · CVSS 5.5
EPSS 0.5% (40th pct)2024-12-10
SolarWinds Web Help Desk Hardcoded Credential Vulnerability
CVE-2024-28987
CISA KEV
Public exploit
Patch
CWE-798
Added to CISA KEV 2024-10-15
Critical · CVSS 9.3
EPSS 93.3% (100th pct)2024-08-21
SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability
CVE-2024-28986
CISA KEV
Public exploit
Patch
CWE-502
Added to CISA KEV 2024-08-15
Critical · CVSS 9.3
EPSS 84.6% (100th pct)2024-08-13
Medium vulnerability · 2022-03-09
CVE-2021-35251
Patch
CWE-209
Medium · CVSS 5.3
EPSS 0.9% (57th pct)2022-03-09
Medium vulnerability · 2021-12-27
CVE-2021-35232
Patch
CWE-798
Medium · CVSS 6.8
EPSS 0.3% (22th pct)2021-12-27
HTTP PUT & DELETE Methods Enabled
CVE-2021-35243
Patch
CWE-749
High · CVSS 7.5
EPSS 0.9% (56th pct)2021-12-23
Medium vulnerability · 2021-08-26
CVE-2021-32076
Patch
CWE-290
Medium · CVSS 5.3
EPSS 1.2% (64th pct)2021-08-26
Medium vulnerability · 2021-01-15
CVE-2019-16961
Medium · CVSS 5.4
EPSS 1.5% (71th pct)2021-01-15
Medium vulnerability · 2021-01-06
CVE-2019-16954
Medium · CVSS 5.4
EPSS 1.3% (68th pct)2021-01-06
Medium vulnerability · 2021-01-04
CVE-2019-16960
Medium · CVSS 5.4
EPSS 1.3% (68th pct)2021-01-04
Medium vulnerability · 2021-01-04
CVE-2019-16956
Medium · CVSS 5.4
EPSS 1.7% (75th pct)2021-01-04

Common weakness types

The CWE weakness categories most often found in SolarWinds Web Help Desk CVEs. Follow any weakness for its full explanation.

CWE-502Deserialization of Untrusted Data5 CVEs
CWE-798Use of Hard-coded Credentials3 CVEs
CWE-1390Weak Authentication2 CVEs
CWE-290Authentication Bypass by Spoofing1 CVE
CWE-321Use of Hard-coded Cryptographic Key1 CVE
CWE-209Generation of Error Message Containing Sensitive Information1 CVE
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')1 CVE
CWE-693Protection Mechanism Failure1 CVE

Disclosure activity by year

How many SolarWinds Web Help Desk CVEs were published each year.

2021

7

2022

1

2024

3

2025

4

2026

7

Other SolarWinds products

Browse vulnerabilities for other products by SolarWinds.

serv-u55 CVEs orion platform51 CVEs SolarWinds Platform45 CVEs access rights manager32 CVEs serv-u file server21 CVEs serv-u ftp server12 CVEs database performance analyzer11 CVEs n-central9 CVEs

All SolarWinds vulnerabilities

Frequently asked questions

Common questions about SolarWinds Web Help Desk vulnerabilities.

How many CVEs does SolarWinds Web Help Desk have?: SolarWinds Web Help Desk has 22 published CVE records since 2021.
How many SolarWinds Web Help Desk CVEs are in CISA KEV?: Yes — 5 of SolarWinds Web Help Desk's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for SolarWinds Web Help Desk vulnerabilities?: Yes — 8 of SolarWinds Web Help Desk's CVEs have a known public exploit.
Which versions of SolarWinds Web Help Desk are affected?: 34 distinct SolarWinds Web Help Desk versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in SolarWinds Web Help Desk CVEs?: SolarWinds Web Help Desk's CVEs most often map to these CWE weakness types: CWE-502 (Deserialization of Untrusted Data), CWE-798 (Use of Hard-coded Credentials), CWE-1390 (Weak Authentication), CWE-290 (Authentication Bypass by Spoofing).
How many critical SolarWinds Web Help Desk vulnerabilities are there?: SolarWinds Web Help Desk has 9 critical and 3 high-severity CVEs.
What is the average severity of SolarWinds Web Help Desk CVEs?: The average CVSS base score across SolarWinds Web Help Desk's scored CVEs is 7.5.

References

All SolarWinds vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track SolarWinds Web Help Desk vulnerabilities

Monitor new SolarWinds Web Help Desk vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References