by Kastro
Paper/Archive/CVE-2025-40551

CVE-2025-40551

SolarWinds Web Help Desk — SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

KEV · due 6 FebEPSS 84%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.7.997 × 2019.9Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

Affected

ProductAffectedFixed inSource
Web Help Desk12.8.8 HF1 and below–CNA

Scores by source

SolarWinds (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

patchsolarwinds.com/trust-center/security-advisories/CVE-2025-40551refdocumentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htmrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40551kevcisa.gov/known-exploited-vulnerabilities-catalog