by Kastro
Paper/Archive/CVE-2025-40536

CVE-2025-40536

SolarWinds Web Help Desk — SolarWinds Web Help Desk Security Control Bypass Vulnerability

KEV · due 15 FebEPSS 74%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (NVD)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.5.995 × 2019.9Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.

Affected

ProductAffectedFixed inSource
Web Help Desk12.8.8 HF1 and below–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SolarWinds (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

patchsolarwinds.com/trust-center/security-advisories/CVE-2025-40536refdocumentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htmrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40536writeuphuntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399kevcisa.gov/known-exploited-vulnerabilities-catalog