Authenticated Remote Code Execution in WebHelpDesk 12.7.8
Priority MEDIUM 40CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent the misuse of this input in the future.
Why it matters now
EPSS 0.01014 63rd percentileScored 2026-11-07
Fix Fixed WebHelpDesk (SolarWinds): 12.7.8 HF 1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SolarWinds | WebHelpDesk | 12.7.8 and previous versions to before 12.7.8 HF 1 | 12.7.8 HF 1 | Patch available | CNA |
- WebHelpDesk VendorSolarWinds Affected 12.7.8 and previous versions to before 12.7.8 HF 1 Fixed in 12.7.8 HF 1 Patch available CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:solarwinds:webhelpdesk:*:*:*:*:*:*:*:* | before 12.7.8 | Vulnerable | SolarWinds |
| cpe:2.3:a:solarwinds:webhelpdesk:12.7.8:-:*:*:*:*:*:* | 12.7.8 | Vulnerable | SolarWinds |
- cpe:2.3:a:solarwinds:webhelpdesk:*:*:*:*:*:*:*:* Versions before 12.7.8 Vulnerable ·SolarWinds
- cpe:2.3:a:solarwinds:webhelpdesk:12.7.8:-:*:*:*:*:*:* Versions 12.7.8 Vulnerable ·SolarWinds
Remediation
- Fix · CNA WebHelpDesk (SolarWinds) Fixed in 12.7.8 HF 1
Timeline
- 2026-10-02 Threatist record created from CVE-2021-35254
- 2026-10-03 Alias added: GHSA-xpr2-v3gx-4h93
References
More SolarWinds Webhelpdesk vulnerabilities
- TI-2019-14429 Formula Injection exists in the export feature in SolarWinds WebHelpDesk 12.7.1 via a… CVSS 3.1HIGH 7.8
- TI-2019-12645 SolarWinds Web Help Desk 12.7.0 allows CSV Injection, also known as Formula Injection, via a file attached to a ticket. CVSS 3.1MEDIUM 6.5
- TI-2021-14125 Hard credentials discovered in SolarWinds Web Help Desk which allows to execute Arbitrary Hibernate Queries CVSS 3.1MEDIUM 6.8
- TI-2019-12641 SolarWinds Web Help Desk 12.7.0 allows XSS via an uploaded SVG document in a request. CVSS 3.1MEDIUM 5.4
- TI-2019-12643 SolarWinds Web Help Desk 12.7.0 allows XSS via the First Name field of a User Account. CVSS 3.1MEDIUM 5.4
Sources
- CVE-2021-35254 · CVE Program
- CVE-2021-35254 · NVD
- FIRST EPSS
- GHSA-xpr2-v3gx-4h93 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences