CVE-2025-40551

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) and involves the application processing input data supplied by an attacker without proper verification of its security during deserialization. An attacker can craft a malicious payload and send it to the vulnerable endpoint without needing to possess any credentials. Processing such a payload leads to execution of arbitrary commands on the server hosting the application.

An attacker can gain the ability to execute arbitrary commands remotely on the server (RCE), which in practice means complete takeover of the system, including access to sensitive data, modification of resources, and potential lateral movement within the internal network.

SolarWinds Web Help Desk should be updated immediately to version 2026.1 or later, in accordance with information contained in the official release notes and SolarWinds security bulletin. Due to active exploitation (CISA KEV), the update should be performed immediately. Until the patch is deployed, it is recommended to restrict access to the application only to trusted networks or IP addresses.

SolarWinds Web Help Desk — versions indicated in the vendor's references (patch available in WHD 2026.1 according to the vendor's release notes)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.