Known vulnerabilities in Web Help Desk 12.8.5 Hotfix 3

Vendor: SolarWinds
Software: Web Help Desk
Version: 12.8.5 Hotfix 3
Software CPE: cpe:2.3:a:solarwinds:whd:*:*:*:*:*:*:*:*
Website: https://www.solarwinds.com/
Total vulnerabilities: 9
Public exploits: 5
Known exploited (KEV): 3
Highest CVSSv4 Score: 9.3

Vulnerabilities by Severity

Severity distribution of vulnerabilities affecting Web Help Desk version 12.8.5 Hotfix 3 Web Help Desk 12.8.5 Hotfix 3 is affected by 9 vulnerabilities: 5 critical, 2 high, 2 medium Critical High Medium Low

Vulnerabilities (9)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU139619 - Resource exhaustion
CVE-2026-28299		 CWE-400 High
No
No
 2026.2 27.07.2026 SB20260727222
#VU122156 - Deserialization of Untrusted Data
CVE-2025-40551		 CWE-502 Critical
Public exploit available
Exploited
 2026.1 30.01.2026 SB2026013035
#VU122155 - Improper Authentication
CVE-2025-40552		 CWE-287 Critical
Public exploit available
No
 2026.1 30.01.2026 SB2026013035
#VU122154 - Deserialization of Untrusted Data
CVE-2025-40553		 CWE-502 Critical
Public exploit available
No
 12.8.8 Hotfix 2, 2026.1 30.01.2026 SB2026013035
#VU122153 - Improper Authentication
CVE-2025-40554		 CWE-287 Critical
Public exploit available
No
 2026.1 30.01.2026 SB2026013035
#VU122152 - Improper Access Control
CVE-2025-40536		 CWE-284 High
Public exploit available
Exploited
 2026.1 30.01.2026 SB2026013035
#VU122151 - Use of Hard-coded Credentials
CVE-2025-40537		 CWE-798 Medium
No
No
 2026.1 30.01.2026 SB2026013035
#VU116030 - Deserialization of Untrusted Data
CVE-2025-26399		 CWE-502 Critical
No
Exploited
 12.8.7 Hotfix 1 23.09.2025 SB2025092357
#VU113572 - Improper Restriction of XML External Entity Reference ('XXE')
CVE-2025-26400		 CWE-611 Medium
No
No
 12.8.7 01.08.2025 SB2025080107