SolarWinds Web Help Desk & pgAdmin4 Vulnerability Advisory: RCE, Cmd Injection, CVEs

Vulnerability Overview Multiple security vulnerabilities exist in SolarWinds Web Help Desk version 2026.2, including Remote Code Execution (RCE), command injection, LDAP injection, Cross-Site Scripting (XSS), and TLS certificate validation bypass. These vulnerabilities could allow attackers to execute arbitrary code, inject malicious commands, obtain sensitive information, or bypass security mechanisms. Affected Scope SolarWinds Web Help Desk: Contains a Remote Code Execution vulnerability that could lead to denial of service. pgAdmin4: Multiple versions contain vulnerabilities including Remote Code Execution, command injection, LDAP injection, Cross-Site Scripting, and TLS certificate validation bypass. Remediation SolarWinds Web Help Desk: Upgrade to the latest version to remediate the Remote Code Execution vulnerability. pgAdmin4: Upgrade to the latest version to remediate all known vulnerabilities. Vulnerability Details SolarWinds CVEs CVE-2026-28299 - Vulnerability Title: SolarWinds Web Help Desk Denial-of-Service Vulnerability - Description: SolarWinds Web Help Desk contains a Remote Code Execution vulnerability that could lead to denial of service. - Severity: 8.2 High - Credit: Tenable Third-party CVEs CVE-2025-12762 - Vulnerability Title: pgAdmin4 Remote Code Execution (RCE) Vulnerability - Description: pgAdmin4 versions 9.9 and earlier contain a Remote Code Execution vulnerability that could allow the execution of arbitrary code. - Severity: 9.8 Critical CVE-2025-12763 - Vulnerability Title: pgAdmin4 Command Injection Vulnerability - Description: pgAdmin4 versions 9.9 and earlier contain a command injection vulnerability that could allow the execution of arbitrary commands. - Severity: 8.8 High CVE-2025-13780 - Vulnerability Title: pgAdmin4 Remote Code Execution (RCE) Vulnerability - Description: pgAdmin4 versions 9.10 and earlier contain a Remote Code Execution vulnerability that could allow the execution of arbitrary code. - Severity: 8.8 High CVE-2025-9636 - Vulnerability Title: pgAdmin4 Cross-Origin Opener Policy (COOP) Vulnerability - Description: pgAdmin4 contains a Cross-Site Scripting vulnerability that could lead to Cross-Site Scripting attacks. - Severity: 7.9 High CVE-2025-12764 - Vulnerability Title: pgAdmin4 LDAP Injection Vulnerability - Description: pgAdmin4 versions 9.9 and earlier contain an LDAP injection vulnerability that could allow the execution of arbitrary LDAP queries. - Severity: 7.5 High CVE-2025-12765 - Vulnerability Title: pgAdmin4 LDAP Authentication TLS Validation Bypass Vulnerability - Description: pgAdmin4 versions 9.9 and earlier contain a TLS certificate validation bypass vulnerability that could lead to Man-in-the-Middle attacks. - Severity: 7.4 High Remediation Recommendations SolarWinds Web Help Desk: Upgrade to the latest version to remediate the Remote Code Execution vulnerability. pgAdmin4: Upgrade to the latest version to remediate all known vulnerabilities. Important Notes Back up important data before upgrading. Follow official documentation guidelines during the upgrade process. Verify that system functionality is normal after the upgrade. Code Block No specific Proof of Concept (POC) code or exploit code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

SolarWinds Web Help Desk & pgAdmin4 Vulnerability Advisory: RCE, Cmd Injection, CVEs