CVE-2025-40552criticalCWE-1390

CVE-2025-40552: critical vulnerability in SolarWinds Web Help Desk

SolarWinds Web Help Desk Authentication Bypass Vulnerability

Published · Updated

Follow this CVE+ Monitor Web Help Desk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

75Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9.8epss 52%
from disclosure to weapon16 days
Published on NVDJan 28
1st PoC+16d
In short

SolarWinds Web Help Desk has a security flaw that lets attackers bypass login requirements and access protected features without valid credentials. This is critical because it allows unauthorized users to perform any action on the system.

Technical detail

An authentication bypass vulnerability in SolarWinds Web Help Desk permits unauthenticated attackers to invoke protected methods and execute administrative actions, circumventing access controls. The vulnerability enables direct exploitation without credential requirements, resulting in complete compromise of system functionality and data access.

Summary generated and translated by AI from the official description.
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SolarWinds · Web Help Desk
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SolarWinds Web Help Desk

In the same product, most dangerous first.

CVE-2024-28987CRITICALSolarWinds Web Help Desk Hardcoded Credential VulnerabilityEPSS 93.3%KEVCVE-2025-26399CRITICALSolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation VulnerabilityEPSS 90.6%KEVCVE-2024-28986CRITICALSolarWinds Web Help Desk Java Deserialization Remote Code Execution VulnerabilityEPSS 84.6%KEVCVE-2025-40551CRITICALSolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 84.2%KEVCVE-2025-40536HIGHSolarWinds Web Help Desk Security Control Bypass VulnerabilityEPSS 73.6%KEVCVE-2025-40553CRITICALSolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 68.0%