CVE-2025-40552

The vulnerability classified as CWE-1390 (Weak Authentication) involves insufficient verification of user identity before performing protected operations in the application. An attacker, remotely and without possessing any credentials, can send crafted requests to application endpoints and bypass authentication mechanisms. This allows access to functions and methods that should be available only to logged-in and authorized users. The attack vector is network-based, requires no user interaction or special preconditions.

An attacker can perform arbitrary protected actions and methods of the application without authentication, which may lead to complete system takeover, disclosure of sensitive data, modification of configuration, or disruption of service availability.

SolarWinds Web Help Desk should be updated to version 2026.1 or later in accordance with information in the vendor's release notes and recommendations published in the SolarWinds security center at the address indicated in the references.

SolarWinds Web Help Desk — versions indicated in vendor references (patches available in WHD 2026.1 release)