CVE-2025-26400

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
SolarWinds	Web Help Desk	12.8.6 and previous versions

References

https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7_release_notes.htmRelease Notes, Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26400Patch, Vendor Advisory

Timeline

Published: Jul 29, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-264016.5Weak encoding for password vulnerability exists in HMI ViewJet C-more series. If this vulnerability is exploited, authentication information CVE-2025-264026.5Protection mechanism failure for some Intel(R) NPU Drivers within Ring 3: User Applications may allow a denial of service. Unprivileged soft CVE-2025-264037.2Out-of-bounds write in the memory subsystem for some Intel(R) Xeon(R) 6 processors when using Intel(R) SGX or Intel(R) TDX may allow a privi CVE-2025-264046.7Uncontrolled search path for some Intel(R) DSA software before version 25.2.15.9 may allow an authenticated user to potentially enable escal CVE-2025-264055.9Improper control of dynamically-managed code resources for some Intel(R) NPU Drivers within Ring 3: User Applications may allow a denial of CVE-2025-264086.1The JTAG interface of Wattsense Bridge devices can be accessed with physical access to the PCB. After connecting to the interface, full acce CVE-2025-264096.8A serial interface can be accessed with physical access to the PCB of Wattsense Bridge devices. After connecting to the interface, access to CVE-2025-26419.8A vulnerability, which was classified as critical, has been found in PHPGurukul Art Gallery Management System 1.0. Affected by this issue is CVE-2025-264109.8The firmware of all Wattsense Bridge devices contain the same hard-coded user and root credentials. The user password can be easily recovere CVE-2025-264118.8An authenticated attacker is able to use the Plugin Manager of the web interface of the Wattsense Bridge devices to upload malicious Python CVE-2025-264126.8The SIMCom SIM7600G modem supports an undocumented AT command, which allows an attacker to execute system commands with root permission on t CVE-2025-264137.5Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer an