CVE-2025-26400: SolarWinds Web Help Desk XXE Vulnerability

CVE-2025-26400 Overview

SolarWinds Web Help Desk contains an XML External Entity (XXE) injection vulnerability that enables authenticated attackers to disclose sensitive information from the underlying host. The flaw is tracked under CWE-611: Improper Restriction of XML External Entity Reference and requires low-privilege access to the application. Alternatively, an attacker with local access to the server can trigger the flaw by modifying configuration files. SolarWinds addressed the issue in Web Help Desk version 12.8.7. Refer to the SolarWinds Security Advisory CVE-2025-26400 for vendor guidance.

Critical Impact
Authenticated attackers can read arbitrary files and internal resources accessible to the Web Help Desk service account through crafted XML input.

Affected Products

SolarWinds Web Help Desk versions prior to 12.8.7
Deployments exposing the Web Help Desk web interface to authenticated users
On-premises SolarWinds Web Help Desk installations

Discovery Timeline

2025-07-29 - CVE-2025-26400 published to the National Vulnerability Database
2026-06-17 - Entry last updated in NVD

Technical Details for CVE-2025-26400

Vulnerability Analysis

The vulnerability resides in an XML parser used by SolarWinds Web Help Desk that does not disable external entity resolution. When the application processes attacker-controlled XML, the parser resolves external entity references defined in a Document Type Definition (DTD). This behavior allows the attacker to force the server to read local files or issue outbound requests to internal systems.

Exploitation requires valid low-privilege credentials to the Web Help Desk application. An attacker with local access to the server can achieve the same outcome by modifying XML configuration files consumed by the service. Successful exploitation results in confidentiality impact only; integrity and availability of the application are not directly affected.

Root Cause

The root cause is an insecurely configured XML parser that accepts inline DTD declarations and resolves external entities. Java-based XML parsers such as SAXParser, DocumentBuilder, and XMLInputFactory expose XXE risk when features like disallow-doctype-decl are not enabled and when external general and parameter entities remain permitted. The Web Help Desk code path that ingests XML inherits these defaults, enabling entity substitution during document parsing.

Attack Vector

An authenticated attacker submits crafted XML containing an external entity referencing a local file such as file:///etc/passwd or an internal URL. The Web Help Desk parser dereferences the entity and returns or embeds the file contents in the parsed data. The vulnerability manifests over the network against the application's HTTP endpoints that accept XML input. See the SolarWinds WHD 12.8.7 Release Notes for the corrected parser configuration.

Detection Methods for CVE-2025-26400

Indicators of Compromise

Web Help Desk access logs containing HTTP POST or PUT requests with XML payloads that include <!DOCTYPE, <!ENTITY, or SYSTEM keywords
Outbound network connections initiated by the Web Help Desk Java process to unexpected internal or external hosts
File reads from /etc/passwd, web.config, or Web Help Desk configuration files by the service account outside normal operational patterns

Detection Strategies

Inspect HTTP request bodies destined for Web Help Desk endpoints and flag XML documents that declare inline DTDs or external entities
Correlate authenticated Web Help Desk sessions with anomalous file access and outbound DNS or HTTP traffic from the application server
Deploy application-layer WAF rules that block XML payloads containing SYSTEM or PUBLIC identifiers in DTD declarations

Monitoring Recommendations

Enable verbose logging on the Web Help Desk application and forward events to a centralized SIEM for correlation
Monitor low-privilege user accounts for unusual XML submission volume or off-hours activity against ticketing endpoints
Alert on process activity where the Web Help Desk Java runtime reads sensitive system files or spawns network sockets to internal management interfaces

How to Mitigate CVE-2025-26400

Immediate Actions Required

Upgrade SolarWinds Web Help Desk to version 12.8.7 or later as documented in the vendor release notes
Audit and rotate credentials for low-privilege Web Help Desk accounts to remove any that may have been leveraged for exploitation
Restrict administrative and local server access to trusted personnel to prevent configuration file tampering

Patch Information

SolarWinds released Web Help Desk 12.8.7 to remediate CVE-2025-26400. Full details and download instructions are available in the SolarWinds WHD 12.8.7 Release Notes and the SolarWinds Security Advisory CVE-2025-26400.

Workarounds

Place Web Help Desk behind a reverse proxy or WAF that strips or rejects XML payloads containing DTD declarations until patching is complete
Limit network egress from the Web Help Desk server to prevent out-of-band data exfiltration if an XXE primitive is used
Restrict the Web Help Desk service account to the minimum file system permissions needed for operation to reduce the scope of file disclosure

bash

# Example egress restriction using iptables to limit outbound traffic
# from the Web Help Desk host to only required destinations
iptables -A OUTPUT -p tcp -d <mail_server_ip> --dport 25 -j ACCEPT
iptables -A OUTPUT -p tcp -d <ldap_server_ip> --dport 389 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -m owner --uid-owner whd -j REJECT
iptables -A OUTPUT -j DROP