SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability

Why this deserves its current priority

A CVSS score is not reported in the current record. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps SolarWinds/Web Help Desk (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for SolarWinds/Web Help Desk.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Sep 23, 2025

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Aug 4, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   May 24, 2026

4. Added to CISA KEV

   Mar 9, 2026

   Evidence: source:kev:kev:kev:record

Sources and claim methodology

• Source referencedocumentation.solarwinds.com
• CISA Known Exploited Vulnerabilities catalogcisa.gov
• Source referencemicrosoft.com
• Source referencesolarwinds.com

Related CVEs

• Suricata defrag: fragmented encapsulated traffic with fragments can lead to deadlockSame generic ecosystem
• SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id}Same generic ecosystem
• LiteLLM: Server-side request forgery via the `user_config` request parameter in LiteLLM ProxySame generic ecosystem
• Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)Same generic ecosystem
• Redocly CLI: Path traversal when using `split` commandSame generic ecosystem
• Redocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`Same generic ecosystem