CVE-2025-26400
Last modified
CVE-2025-26400 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files.. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Solarwinds | Web Help Desk | < 12.8.7 |
References
- https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7_release_notes.htmRelease Notes, Vendor Advisory
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26400Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-26400?
How severe is CVE-2025-26400?
How do I fix CVE-2025-26400?
Are you affected by CVE-2025-26400?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST