CVE-2025-40536: high-severity vulnerability in SolarWinds Web Help Desk
SolarWinds Web Help Desk Security Control Bypass Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
SolarWinds Web Help Desk has a flaw that lets unauthenticated attackers bypass security controls and access restricted features they shouldn't be able to use. This is serious because attackers can gain unauthorized access without needing valid credentials.
The vulnerability allows an unauthenticated attacker to bypass security controls in SolarWinds Web Help Desk and access restricted functionality. The attack vector requires network access but no prior authentication, potentially leading to unauthorized access to sensitive administrative or operational features. The high CVSS score (8.1) reflects the significance of the control bypass and the ease of exploitation.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.