Actively exploited vulnerabilities affecting SolarWinds products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2026-28318https://wildfortech.com/security#CVE-2026-28318This vulnerability in SolarWinds Serv-U allows any unauthenticated attacker to crash the file transfer service by sending a specially crafted POST request using a deflate content-encoding header. Because no authentication is required, the attack surface is wide — anyone who can reach the Serv-U service over the network can trigger a denial of service, taking the service offline and disrupting file transfer operations until it is restarted or patched.Fri, 05 Jun 2026 00:00:00 GMTSolarWindsServ-Uhttps://wildfortech.com/security#CVE-2025-26399https://wildfortech.com/security#CVE-2025-26399SolarWinds Web Help Desk contains a deserialization flaw in its AjaxProxy component that allows an attacker to execute arbitrary commands directly on the host machine. This is a critical remote code execution class vulnerability, and it has already been linked to real ransomware attacks in the wild. Any organization running Web Help Desk is at risk of full system compromise, making this an urgent priority for IT and security teams.Mon, 09 Mar 2026 00:00:00 GMTSolarWindsWeb Help Deskhttps://wildfortech.com/security#CVE-2025-40536https://wildfortech.com/security#CVE-2025-40536SolarWinds Web Help Desk has a flaw that lets unauthenticated attackers bypass security controls and reach functionality that should be restricted to authorized users. Because no login is required to exploit this, the attack surface is broad — anyone who can reach the application over the network is a potential threat actor. Help desk platforms typically handle sensitive tickets, credentials, and user data, making unauthorized access particularly damaging.Thu, 12 Feb 2026 00:00:00 GMTSolarWindsWeb Help Deskhttps://wildfortech.com/security#CVE-2025-40551https://wildfortech.com/security#CVE-2025-40551SolarWinds Web Help Desk contains a deserialization flaw that allows attackers to execute arbitrary commands on the underlying host machine without any credentials. Deserialization vulnerabilities are particularly dangerous because they can be triggered remotely and require no prior access or authentication, giving attackers a direct path to full system compromise. Any organization running this product is potentially exposed to complete server takeover.Tue, 03 Feb 2026 00:00:00 GMTSolarWindsWeb Help Desk