CVE-2025-40536: SolarWinds Web Help Desk security control bypass allows unauthenticated access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or interaction required, KEV listing and very high EPSS make this an urgent patch-first exposure.

What it is

SolarWinds Web Help Desk contains a security control bypass (CWE-693) that lets an unauthenticated attacker reach restricted functionality. It is rated CVSS 9.8 critical and is listed in CISA KEV, so it should be treated as an urgent exposure for any internet-facing instance.

Impact

An attacker can reach functionality that should require authentication, potentially leading to full compromise of confidentiality, integrity and availability given the CVSS scope. The record does not specify which functions are exposed or whether code execution follows.

Attack surface

Reachable over the network with no authentication and no user interaction (AV:N/AC:L/PR:N/UI:N). Any Web Help Desk instance exposed to untrusted networks is in scope.

Exploitation

CISA added it to KEV on 2026-02-12 with a 2026-02-15 remediation due date, and EPSS is 0.8196 (99.6th percentile), indicating active exploitation is expected or observed. A third-party advisory reference concerns active exploitation of a related Web Help Desk CVE, not this one specifically.

What to do

• Apply the SolarWinds Web Help Desk 2026.1 release or the vendor's specified fix per the security advisory.
• If patching is not immediately possible, restrict network access to Web Help Desk to trusted management networks and remove direct internet exposure.
• Follow CISA BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
• Audit for unauthorized changes or new accounts made through restricted functionality after exposure.
• Confirm no unauthenticated access paths remain by testing from an external vantage point after remediation.

Detection

• Review Web Help Desk access logs for requests to administrative or restricted endpoints from unauthenticated sessions.
• Alert on anomalous authentication events, new privileged accounts, or configuration changes outside change windows.
• Monitor for outbound connections or process activity on the Web Help Desk host that does not match normal application behavior.
• Correlate Web Help Desk logs with perimeter logs for scanning or exploitation attempts against the service.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.