SolarWinds Web Help Desk & pgAdmin4 Vulnerability Advisories: Auth Bypass, RCE, CVE-2026-28299, CVE-2025-12762

Vulnerability Overview Security vulnerabilities have been patched in SolarWinds Web Help Desk version 2026.2.1, including: 1. SolarWinds Web Help Desk Denial-of-Service Vulnerability - CVE-ID: CVE-2026-28299 - Description: A denial-of-service vulnerability exists in SolarWinds Web Help Desk, which an attacker can exploit to cause the server to crash. - Severity: 8.2 High - Credit: Tenable 2. SolarWinds SAML Authentication Bypass Vulnerability - CVE-ID: CVE-2026-28323 - Description: An SAML authentication bypass vulnerability exists in SolarWinds Web Help Desk, which an attacker can exploit to bypass SAML 2.0 authentication. - Severity: 9.8 Critical - Credit: Dhabaleswar Das 3. pgAdmin4 Remote Code Execution (RCE) Vulnerability - CVE-ID: CVE-2025-12762 - Description: A remote code execution vulnerability exists in pgAdmin4 version 9.9 and earlier, which an attacker can exploit to execute arbitrary commands on the server. - Severity: 9.8 Critical 4. pgAdmin4 Command Injection Vulnerability - CVE-ID: CVE-2025-12763 - Description: A command injection vulnerability exists in pgAdmin4 version 9.9 and earlier, which an attacker can exploit to execute arbitrary system commands. - Severity: 8.8 High 5. pgAdmin4 Remote Code Execution (RCE) Vulnerability - CVE-ID: CVE-2025-13780 - Description: A remote code execution vulnerability exists in pgAdmin4 version 9.10 and earlier, which an attacker can exploit to execute arbitrary commands on the server. - Severity: 8.8 High 6. pgAdmin4 Cross-Origin Opener Policy (COOP) Vulnerability - CVE-ID: CVE-2025-9636 - Description: A Cross-Origin Opener Policy (COOP) vulnerability exists in pgAdmin4 version 9.7 and earlier, which an attacker can exploit to perform OAuth flow attacks, leading to account takeover, data leakage, and privilege escalation. - Severity: 7.9 High 7. pgAdmin4 LDAP Injection Vulnerability - CVE-ID: CVE-2025-12764 - Description: An LDAP injection vulnerability exists in pgAdmin4 version 9.9 and earlier, which an attacker can exploit by injecting special LDAP characters, causing a denial of service on the server. - Severity: 7.5 High 8. pgAdmin4 LDAP Authentication TLS Validation Bypass Vulnerability - CVE-ID: CVE-2025-12765 - Description: A TLS validation bypass vulnerability exists in LDAP authentication in pgAdmin4 version 9.9 and earlier, which an attacker can exploit to bypass TLS certificate validation. - Severity: 7.4 High Affected Products SolarWinds Web Help Desk 2026.2.1 pgAdmin4 version 9.9 and earlier pgAdmin4 version 9.10 and earlier pgAdmin4 version 9.7 and earlier Remediation SolarWinds Web Help Desk 2026.2.1: Upgrade to the latest version to remediate all the aforementioned vulnerabilities. pgAdmin4: Upgrade to the latest version to remediate all the aforementioned vulnerabilities. Proof of Concept (POC) or Exploit Code No specific POC code or exploit code was provided in this page.

Goal Reached Thanks to every supporter — we hit 100%!

SolarWinds Web Help Desk & pgAdmin4 Vulnerability Advisories: Auth Bypass, RCE, CVE-2026-28299, CVE-2025-12762