CVE-2025-40551criticalunder attackCWE-502

CVE-2025-40551: critical vulnerability in SolarWinds Web Help Desk

SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

Published · Updated

95Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 84%
from disclosure to weapon0 days
Published on NVDJan 28
metasploitJan 28
CISA KEV+6d
exploitation probability
84%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
Action required by CISAfederal deadline: 2026-02-06

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

SolarWinds Web Help Desk can be hacked remotely without a password because it unsafely processes untrusted data, allowing attackers to run commands on the server.

Technical detail

The application deserializes untrusted input without validation (CWE-502), enabling unauthenticated remote code execution via crafted serialized objects. An attacker can exploit this network-accessible vulnerability to achieve arbitrary command execution on the host with the application's privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SolarWinds · Web Help Desk
Related CVEs — SolarWinds Web Help Desk

In the same product, most dangerous first.

CVE-2024-28987CRITICALSolarWinds Web Help Desk Hardcoded Credential VulnerabilityEPSS 93.3%KEVCVE-2025-26399CRITICALSolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation VulnerabilityEPSS 89.5%KEVCVE-2024-28986CRITICALSolarWinds Web Help Desk Java Deserialization Remote Code Execution VulnerabilityEPSS 84.6%KEVCVE-2025-40536HIGHSolarWinds Web Help Desk Security Control Bypass VulnerabilityEPSS 73.6%KEVCVE-2025-40553CRITICALSolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 68.0%CVE-2025-40554CRITICALSolarWinds Web Help Desk Authentication Bypass VulnerabilityEPSS 60.6%
References
https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htmhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40551https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40551