Vulnerabilidades do Solarwinds Web Help Desk

CVE-2026-28299 Alta · 7.5 CWE-770 02/06/2026

SolarWinds Web Help Desk Denial-of-Service Vulnerability

SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due to insufficient memory.

CVE-2025-40554 Crítica · 9.8 Exploit público CWE-1390 28/01/2026

Bypass de autenticação no SolarWinds Web Help Desk (CVE-2025-40554)

A SolarWinds Web Help Desk foi considerada suscetível a uma vulnerabilidade de bypass de autenticação que, se explorada, poderia permitir que um atacante invocasse ações específicas dentro do Web Help Desk.

CVE-2025-40553 Crítica · 9.8 CWE-502 28/01/2026

SolarWinds Web Help Desk: desserialização de dados não confiáveis levando a RCE

Foi identificado que o SolarWinds Web Help Desk é suscetível a uma vulnerabilidade de desserialização de dados não confiáveis que pode levar à execução remota de código, o que permitiria a um atacante executar comandos na máquina hospedeira. Isso poderia ser explorado sem autenticação.

CVE-2025-40552 Crítica · 9.8 Exploit público CWE-1390 28/01/2026

Desvio de autenticação no SolarWinds Web Help Desk (CVE-2025-40552)

O SolarWinds Web Help Desk foi considerado suscetível a uma vulnerabilidade de desvio de autenticação que, se explorada, permitiria que um agente malicioso executasse ações e métodos que deveriam ser protegidos por autenticação.

CVE-2025-40537 Alta · 7.5 CWE-798 28/01/2026

SolarWinds Web Help Desk Hardcoded Credentials Vulnerability

SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administrative functions.

CVE-2025-40551 Crítica · 9.8 KEV Urgente · 79 Exploit público CWE-502 28/01/2026

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

CVE-2025-40536 Crítica · 9.8 KEV Urgente · 80 Exploit público CWE-693 28/01/2026

SolarWinds Web Help Desk Security Control Bypass Vulnerability

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.

CVE-2025-26399 Crítica · 9.8 KEV Urgente · 83 Exploit público Ransomware CWE-502 23/09/2025

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.

CVE-2024-28987 Crítica · 9.1 KEV Urgente · 83 Exploit público CWE-798 21/08/2024

SolarWinds Web Help Desk Hardcoded Credential Vulnerability

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.

CVE-2024-28986 Crítica · 9.8 KEV Alta · 67 Exploit público CWE-502 13/08/2024

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing. However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.