Vulnerability record · CVE-2025-40551 · published 28 January 2026
CVE-2025-40551: SolarWinds Web Help Desk unauthenticated deserialization RCE
Solarwinds · Web Help Desk
SolarWinds Web Help Desk contains an untrusted data deserialization flaw (CWE-502) that can lead to remote code execution, allowing an attacker to run commands on the host. It is exploitable without authentication, and the vendor has published a fixed release. Because the product is internet-facing in many deployments and the flaw is pre-auth, it is a serious exposure.
Description
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityPre-auth network RCE with a 9.8 CVSS score, confirmed exploitation via CISA KEV, and a very high EPSS probability.
What it is
SolarWinds Web Help Desk contains an untrusted data deserialization flaw (CWE-502) that can lead to remote code execution, allowing an attacker to run commands on the host. It is exploitable without authentication, and the vendor has published a fixed release. Because the product is internet-facing in many deployments and the flaw is pre-auth, it is a serious exposure.
Impact
An unauthenticated attacker can execute arbitrary commands on the Web Help Desk host, giving full control of that server and any data or credentials it holds.
Attack surface
Reachable over the network via the Web Help Desk service; the CVSS vector shows AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are required. The specific endpoint or parameter is not stated in the record.
Exploitation
CISA added this to the Known Exploited Vulnerabilities catalog on 2026-02-03, indicating exploitation in the wild, and EPSS gives a 30-day probability of 0.83622 (99.67th percentile). No ransomware campaign use is documented.
What to do
- Upgrade Web Help Desk to the fixed version listed in the SolarWinds 2026.1 release notes or later.
- If patching cannot be done immediately, restrict network access to the Web Help Desk service to trusted management networks only.
- Follow CISA KEV required action and BOD 22-01 guidance; discontinue use if no mitigation is available.
- Review the SolarWinds trust center advisory for any vendor-supplied workarounds and apply them.
- Rotate credentials and secrets stored on or reachable from the Web Help Desk host after patching.
Detection
- Hunt for unexpected child processes spawned by the Web Help Desk service (java/webhelpdesk) on the host.
- Monitor Web Help Desk logs and HTTP access logs for anomalous requests or serialized payload patterns.
- Alert on outbound network connections from the Web Help Desk server to unfamiliar hosts.
- Check for new or modified files in Web Help Desk application and web directories.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2025-40551 to the Known Exploited Vulnerabilities catalog on 3 February 2026 as "SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 6 February 2026.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2025-40551 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2025-40551), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
