What’s Vulnerable › Vulnerabilities

CVE-2021-35254: Authenticated Remote Code Execution in WebHelpDesk 12.7.8

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-25 · updated 2026-06-17
• Weakness: CWE-20

Description

SolarWinds received a report of a vulnerability related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent the misuse of this input in the future.

Affected products

• SolarWinds WebHelpDesk: before 12.7.8; 12.7.8 — fixed in 12.7.8

How to fix

Upgrade to a fixed version: SolarWinds WebHelpDesk 12.7.8. Check the vendor advisory for mitigations.

References

• https://support.solarwinds.com/SuccessCenter/s/article/Web-Help-Desk-12-7-8-Hotfix-1-Release-Notes?language=en_US
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35254
• https://support.solarwinds.com/SuccessCenter/s/article/Web-Help-Desk-12-7-8-Hotfix-1-Release-Notes?language=en_US
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2021-35254

Get alerted when CVE-2021-35254 or the next vulnerability affects your stack