CVE-2025-26400: 
SolarWinds Web Help Desk vulnerability analysis and mitigation

SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection (XXE) vulnerability, identified as CVE-2025-26400, discovered on July 29, 2025. This vulnerability affects SolarWinds Web Help Desk version 12.8.6 and all previous versions (SolarWinds Advisory).

The vulnerability is classified as an XML External Entity Injection (XXE) with a CVSS v3.1 base score of 5.3 (Medium). The vulnerability is tracked under CWE-611 (Improper Restriction of XML External Entity Reference). The attack vector is network-based with high attack complexity, requiring low privileges and no user interaction (NVD).

The vulnerability could lead to information disclosure if successfully exploited. The impact primarily affects the confidentiality of the system, with high confidentiality impact, while maintaining no impact on integrity and availability (SolarWinds Advisory).

SolarWinds has released version 12.8.7 as a fix for this vulnerability. Users are advised to upgrade to this version to mitigate the risk (WHD Release Notes).

The vulnerability was responsibly disclosed by security researchers DieuLink, Nhiephon and chung96vn from GCSC Vietnam, who worked with SolarWinds security, product, and engineering teams to address the vulnerability (WHD Release Notes).