WHD 2026.1 release notes
Release date: January 28, 2026
Here's what's new in WHD 2026.1. You can find the applicable system requirements here.
To view release notes, system requirements, and product guide PDFs for supported versions of WHD, see WHD previous versions. To view release notes for multiple versions
New features and improvements in WHD
NextGen WHD: Updated language, framework, and user interface
WHD has been updated with a modern underlying language and framework, improving performance, security, and maintainability.
It also brings a new, redesigned Client user interface, improving efficiency and ease of use. You have the option to enable the new user interface or keep using the old interface.
To start the NextGen WHD, perform the following steps:
-
Go to
<web help desk home directory>/whd-nextgen/. -
Run the
whd_nextgen.batfile.
-
When the CLI screen appears, wait until the application starts.
Closing the CLI screen shuts the application down.
-
To access the modern client user interface, use the following URL format:
https://<DomainName/HostAddress>/helpdesk/nextgen/login
You can check your logs by going to the following directory:
<web help desk home directory>/log/ whd-nextgen.log
Web Help Desk is shipped with a built-in admin account and demo client account, and they are linked by default. As a precaution, it is recommended to create a new client account to link to the admin account in production environments. For more information, see Set up a secure configuration.
Fixed CVEs
At SolarWinds, we prioritize the swift resolution of CVEs to ensure the security and integrity of our software. In this release, we have successfully addressed the following CVEs.
SolarWinds CVEs
SolarWinds would like to thank our Security Researchers below for reporting on the issue in a responsible manner and working with our security, product, and engineering teams to fix the vulnerability.
| CVE-ID | Vulnerability Title | Description | Severity | Credit |
|---|---|---|---|---|
| CVE-2025-40536 | SolarWinds Web Help Desk Security Control Bypass Vulnerability | SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality. | 8.8 High | Jimi Sebree from Horizon3.ai |
| CVE-2025-40537 | SolarWinds Web Help Desk Hardcoded Credentials Vulnerability | SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administrative functions. | 7.5 High | Jimi Sebree from Horizon3.ai |
| CVE-2025-40551 | SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution which would allow an attacker to run commands on the host machine. This could be exploited without authentication. | 9.8 Critical | Jimi Sebree from Horizon3.ai |
| CVE-2025-40552 | SolarWinds Web Help Desk Authentication Bypass Vulnerability | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication. | 9.8 Critical | Piotr Bazydlo from watchTowr |
| CVE-2025-40553 | SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution which would allow an attacker to run commands on the host machine. This could be exploited without authentication. | 9.8 Critical | Piotr Bazydlo from watchTowr |
| CVE-2025-40554 | SolarWinds Web Help Desk Authentication Bypass Vulnerability | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability, which if exploited, could allow an attacker to invoke specific actions within Web Help Desk. | 9.8 Critical | Piotr Bazydlo from watchTowr |
Fixed customer issues
| Case number | Description |
|---|---|
| 01739435 | Fixed an encryption error in the FIPS environment. |
| 02018068 | Removed inactive and on-vacation techs from the @mention tech dropdown. |
| 01766567, 01802424 | Quick Tickets and Bulk Actions now work correctly when a custom field height higher than 3 is configured. |
| n/a | Replaced AJAX-based file upload (Wonder project) with an alternate upload implementation and removed the JABSORB dependency. |
| n/a | A warning message is displayed when any user is allowed to create an account without domain restructions. |
| n/a | A warning message with a reminder to change the default admin password is displayed in the startup wizard |
| 01920942 | Date type custom field shows correct dates. |
Installation or upgrade
For new installations, you can download the installer from the SolarWinds website or from the Customer Portal. For more information, see the WHD Installation and Upgrade Guide.
-
WHD supports Windows Server 2019 and 2022 for production environments and Windows 11 for trial evaluations. These operating system require additional setup to install. See the WHD Installation and Upgrade Guide for instructions.
-
WHD no longer includes the additional configuration files required to enable Federal Information Processing Standards (FIPS) mode in the application. To install WHD and enable FIPS, see Enable FIPS in a new deployment in the WHD Administrator Guide.
For upgrades, use Upgrade WHD to plan and execute your upgrade.
-
Determine your upgrade path.
-
Download and install the upgrade package(s) from the SolarWinds Customer Portal.
-
After you have upgraded Releases, download and install any available hotfixes for this version of Releases. Hotfixes are available in the Customer Portal.
After you complete the installation, see the WHD Getting Started Guide. This guide picks up right after the installation process and walks you through the initial steps you need to take to start using the application.
Known issues
Features temporarily unavailable in NextGen WHD
The following features are temporarily unavailable in NextGen WHD. They are continously available in the legacy Client user interface:
-
SAML Authentication
Only Basic Authentication is available.
-
Linux Support
Not supported due to Next.js not listening on required localhost ports.
-
macOS Support
Not supported for Sonoma, Sequoia, Tahoe flavors due to Next.js 21 incompatibility.
-
Asset Reservation by Client
-
Approval Process
CAB Approval: Not supported
Location Approval: Not supported
Department Approval: Not supported
Legal notices
© 2026 SolarWinds Worldwide, LLC. All rights reserved.
This document may not be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the prior written consent of SolarWinds. All right, title, and interest in and to the software, services, and documentation are and shall remain the exclusive property of SolarWinds, its affiliates, and/or its respective licensors.
SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS, OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON THE DOCUMENTATION, INCLUDING WITHOUT LIMITATION NONINFRINGEMENT, ACCURACY, COMPLETENESS, OR USEFULNESS OF ANY INFORMATION CONTAINED HEREIN. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS, NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY, EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
The SolarWinds, SolarWinds & Design, Orion, and THWACK trademarks are the exclusive property of SolarWinds Worldwide, LLC or its affiliates, are registered with the U.S. Patent and Trademark Office, and may be registered or pending registration in other countries. All other SolarWinds trademarks, service marks, and logos may be common law marks or are registered or pending registration. All other trademarks mentioned herein are used for identification purposes only and are trademarks of (and may be registered trademarks) of their respective companies.