CVE-2025-40554criticalobserved exploitationCWE-1390

CVE-2025-40554: critical vulnerability in SolarWinds Web Help Desk

SolarWinds Web Help Desk Authentication Bypass Vulnerability

Published · Updated

Follow this CVE+ Monitor Web Help Desk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

97Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.8epss 61%
from disclosure to weapon1 day
Published on NVDJan 28
1st PoC+1d
VulnCheck+93d
In short

SolarWinds Web Help Desk has a flaw that lets attackers skip authentication and perform actions they shouldn't be able to do. This is critical because it gives unauthorized access to a system meant to manage support tickets and user data.

Technical detail

An authentication bypass vulnerability in SolarWinds Web Help Desk allows unauthenticated attackers to invoke arbitrary actions without valid credentials. The vulnerability bypasses the authentication mechanism entirely, granting unauthorized access to sensitive functions and data within the application.

Summary generated and translated by AI from the official description.
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SolarWinds · Web Help Desk
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SolarWinds Web Help Desk

In the same product, most dangerous first.

CVE-2024-28987CRITICALSolarWinds Web Help Desk Hardcoded Credential VulnerabilityEPSS 93.3%KEVCVE-2025-26399CRITICALSolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation VulnerabilityEPSS 90.6%KEVCVE-2024-28986CRITICALSolarWinds Web Help Desk Java Deserialization Remote Code Execution VulnerabilityEPSS 84.6%KEVCVE-2025-40551CRITICALSolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 84.2%KEVCVE-2025-40536HIGHSolarWinds Web Help Desk Security Control Bypass VulnerabilityEPSS 73.6%KEVCVE-2025-40553CRITICALSolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 68.0%