Loading story…
SolarWinds released security updates for Web Help Desk (WHD) to address multiple critical vulnerabilities that could allow unauthenticated remote attackers to bypass authentication and achieve remote code execution (RCE). The patched issues include two critical authentication bypass flaws, CVE-2025-40552 and CVE-2025-40554 (reported by watchTowr researcher Piotr Bazydlo), and two critical RCE flaws tied to untrusted data deserialization, CVE-2025-40553 (Bazydlo) and CVE-2025-40551 (reported by Horizon3.ai researcher Jimi Sebree), enabling remote command execution without prior access.
SolarWinds also fixed a high-severity hardcoded credentials issue, CVE-2025-40537, which could enable unauthorized access to administrative functions under certain conditions. The vendor advised administrators to upgrade to Web Help Desk 2026.1 and patch quickly, noting WHD has a history of being targeted and previously had vulnerabilities flagged as actively exploited by CISA, reinforcing the likelihood of rapid attacker interest following disclosure and patch availability.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Researchers reported that over 170 internet-exposed SolarWinds Web Help Desk installations remained vulnerable to CVE-2025-40551 after active exploitation was confirmed, highlighting continued exposure despite available patches.
Following the KEV addition, CISA set an urgent remediation deadline of February 6, 2026 for affected federal agencies and urged immediate patching or isolation of exposed systems.
CISA flagged SolarWinds Web Help Desk CVE-2025-40551 as actively exploited in attacks, added it to the Known Exploited Vulnerabilities catalog, and ordered U.S. federal civilian agencies to remediate under BOD 22-01.
Rapid7 said remote vulnerability checks for the four critical SolarWinds Web Help Desk CVEs were included in its January 28 content release for certain security products.
Horizon3.ai and watchTowr publicly detailed how multiple Web Help Desk weaknesses could be chained to achieve unauthenticated remote code execution, including AjaxProxy/JSON-RPC deserialization paths, request-filter bypasses, static credentials, and indicators of compromise.
SolarWinds released Web Help Desk 2026.1 and published a security advisory addressing six vulnerabilities affecting versions 12.8.8 Hotfix 1 and earlier, including four critical flaws for unauthenticated RCE and authentication bypass plus two high-severity issues involving access control bypass and hardcoded credentials.
As part of remediation efforts, SolarWinds issued a preview release containing fixes ahead of public availability of the final patched version.
SolarWinds acknowledged and confirmed the reported Web Help Desk vulnerabilities during the coordinated disclosure process.
Horizon3.ai disclosed vulnerabilities in SolarWinds Web Help Desk to SolarWinds PSIRT, beginning the coordinated disclosure process for what became CVE-2025-40551 and related issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
16 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcerescana.com
Open sourcehorizon3.ai
Open sourcerapid7.com
Open sourcebleepingcomputer.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Cybersecurity and Infrastructure Security Agency (**CISA**) added **CVE-2025-40551**—a critical (CVSS 9.8) *SolarWinds Web Help Desk (WHD)* vulnerability—to its **Known Exploited Vulnerabilities (KEV)** catalog after confirming active exploitation. The flaw is described as **deserialization of untrusted data** that can enable **unauthenticated remote code execution**, potentially allowing full compromise of affected WHD servers; the issue was reported to SolarWinds by Horizon3.ai researcher **Jimi Sebree**. CISA also issued a directive requiring U.S. federal civilian agencies to patch CVE-2025-40551 by the stated deadline, and SolarWinds released a fix in *Web Help Desk* version **2026.1**. Reporting tied the bug to a prior WHD issue (**CVE-2024-28986**) and characterized CVE-2025-40551 as part of a sequence of vulnerabilities involving bypasses of earlier fixes; CISA’s KEV update also included additional exploited flaws in **Sangoma FreePBX** (including **CVE-2019-19006** and **CVE-2025-64328**) and **GitLab** (**CVE-2021-39935**, SSRF), expanding the set of vulnerabilities agencies must remediate under KEV timelines.
Jun 29, 2026
SolarWinds warned that multiple vulnerabilities in **Web Help Desk** are being actively exploited, with reporting highlighting a critical flaw that can lead to **remote code execution** on exposed help-desk servers. Public references tie the activity to `CVE-2025-40554`, while additional SolarWinds advisories and third-party research point to related issues including `CVE-2025-40552`, `CVE-2025-40553`, and `CVE-2025-40536`, indicating a broader security problem affecting the product. Security researchers and defenders published proof-of-concept material and detection guidance shortly after disclosure, including a watchTowr repository focused on Web Help Desk exploitation and a GitHub Gist describing **uncommon process activity** associated with compromise. The combination of vendor advisories, media reporting, and public exploit research indicates that attackers moved quickly to weaponize the flaws, increasing risk for organizations that have not patched, isolated, or monitored SolarWinds Web Help Desk deployments.
Jul 12, 2026
SolarWinds released a security update for **Web Help Desk 2026.1 and all previous versions** to remediate **`CVE-2026-28299`**, a network-exploitable denial-of-service vulnerability. According to the vendor notice cited by EG-FinCIRT, the flaw has **low attack complexity** and can be triggered **without privileges or user interaction**, increasing the risk of opportunistic exploitation against exposed systems. Successful exploitation could exhaust memory, crash the Web Help Desk server, and disrupt service availability. Organizations using SolarWinds Web Help Desk were urged to validate and deploy the update as soon as testing is complete to reduce the risk of outages caused by unauthenticated attacks.
Jul 8, 2026