CVE-2025-26400

6.5 mediumEPSS 0.3%

Medium (6.5) in solarwinds web help desk. EPSS 0.3% chance of exploitation in the next 30 days.

SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 24% of CVEs (scores of 2026-10-31)
CWE: CWE-611
Published: 2025-07-29
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

solarwinds:web_help_desk

References

https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26400

Check your stack JSON