SolarWinds Web Help Desk Hardcoded Credential Vulnerability

Why this deserves its current priority

A CVSS score is not reported in the current record. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps solarwinds/webhelpdesk (generic), SolarWinds/Web Help Desk (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for solarwinds/webhelpdesk, SolarWinds/Web Help Desk.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Aug 21, 2024

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Oct 21, 2025

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   May 24, 2026

4. Added to CISA KEV

   Oct 15, 2024

   Evidence: source:kev:kev:kev:record

Sources and claim methodology

• Source referencesupport.solarwinds.com
• CISA Known Exploited Vulnerabilities catalogcisa.gov
• Source referencesolarwinds.com
• Source referencetheregister.com

Related CVEs

• Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlockSame generic ecosystem
• SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id}Same generic ecosystem
• LiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM ProxySame generic ecosystem
• Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)Same generic ecosystem
• Redocly CLI: Path traversal when using `split` commandSame generic ecosystem
• Redocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`Same generic ecosystem