Critical RCE and Authentication Bypass Vulnerabilities in SolarWinds Web Help Desk

SolarWinds released security updates for Web Help Desk (WHD) to address multiple critical vulnerabilities that could allow unauthenticated remote attackers to bypass authentication and achieve remote code execution (RCE). The patched issues include two critical authentication bypass flaws, CVE-2025-40552 and CVE-2025-40554 (reported by watchTowr researcher Piotr Bazydlo), and two critical RCE flaws tied to untrusted data deserialization, CVE-2025-40553 (Bazydlo) and CVE-2025-40551 (reported by Horizon3.ai researcher Jimi Sebree), enabling remote command execution without prior access.

SolarWinds also fixed a high-severity hardcoded credentials issue, CVE-2025-40537, which could enable unauthorized access to administrative functions under certain conditions. The vendor advised administrators to upgrade to Web Help Desk 2026.1 and patch quickly, noting WHD has a history of being targeted and previously had vulnerabilities flagged as actively exploited by CISA, reinforcing the likelihood of rapid attacker interest following disclosure and patch availability.