actively-exploited-vulnerabilitygovernment-vulnerability-catalogwidely-deployed-product-advisoryinternet-facing-service-vulnerability

CISA Orders Patching of Exploited SolarWinds Web Help Desk RCE (CVE-2025-40551)

Active Exploitation · 5 sources · Updated 4mo ago · First seen Feb 3, 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-40551—a critical (CVSS 9.8) SolarWinds Web Help Desk (WHD) vulnerability—to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. The flaw is described as deserialization of untrusted data that can enable unauthenticated remote code execution, potentially allowing full compromise of affected WHD servers; the issue was reported to SolarWinds by Horizon3.ai researcher Jimi Sebree.

CISA also issued a directive requiring U.S. federal civilian agencies to patch CVE-2025-40551 by the stated deadline, and SolarWinds released a fix in Web Help Desk version 2026.1. Reporting tied the bug to a prior WHD issue (CVE-2024-28986) and characterized CVE-2025-40551 as part of a sequence of vulnerabilities involving bypasses of earlier fixes; CISA’s KEV update also included additional exploited flaws in Sangoma FreePBX (including CVE-2019-19006 and CVE-2025-64328) and GitLab (CVE-2021-39935, SSRF), expanding the set of vulnerabilities agencies must remediate under KEV timelines.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Dec 5, 2025 – Feb 3, 2026

Feb 3, 20269mo ago
CISA orders federal agencies to patch SolarWinds WHD by February 6
After warning that attackers were actively exploiting CVE-2025-40551, CISA set an accelerated deadline of February 6, 2026 for federal civilian agencies to patch the SolarWinds Web Help Desk flaw. The other newly added KEV vulnerabilities were given a later remediation deadline of February 24, 2026.
Feb 3, 20269mo ago
CISA adds CVE-2025-40551 and three other flaws to the KEV catalog
CISA updated its Known Exploited Vulnerabilities catalog to add SolarWinds Web Help Desk CVE-2025-40551, two Sangoma FreePBX flaws, and GitLab CVE-2021-39935, citing active exploitation or credible in-the-wild risk. The KEV addition formally required U.S. federal civilian agencies to remediate the issues under BOD 22-01.
Jan 28, 20269mo ago
SolarWinds releases Web Help Desk 2026.1 to patch CVE-2025-40551
SolarWinds disclosed CVE-2025-40551 and released Web Help Desk version 2026.1 to fix the critical unauthenticated deserialization flaw, along with several other security issues. The patch release followed reports from Horizon3.ai and watchTowr.
Dec 5, 202511mo ago
Horizon3.ai reports SolarWinds WHD flaw CVE-2025-40551 to SolarWinds
Horizon3.ai researcher Jimi Sebree traced a new SolarWinds Web Help Desk vulnerability, CVE-2025-40551, back to an earlier 2024 issue and reported it to SolarWinds. The report was made on December 5, 2025.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

1 linked

Unauthenticated Deserialization RCE in SolarWinds Web Help Desk (CVE-2025-40551)

Affected products

1 linked

Web Help Desk

Organizations

1 linked

SolarWinds

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

5 references tracked. Mallory keeps watching after this page renders.

Critical SolarWinds Web Help Desk bug under attack • The RegisterOpen source ↗

The Hacker NewsNews · Feb 4, 2026

CISA Adds Actively Exploited SolarWinds Web Help Desk RCE to KEV CatalogOpen source ↗

CyberthroneNews · Feb 4, 2026

CISA’s adds 4 vulnerabilitis to KEV Catalog - TheCyberThroneOpen source ↗

Security AffairsNews · Feb 3, 2026

U.S. CISA adds SolarWinds Web Help Desk, Sangoma FreePBX, and GitLab flaws to its Known Exploited Vulnerabilities catalogOpen source ↗

The Record MediaNews · Feb 3, 2026

CISA orders federal agencies to patch exploited SolarWinds bug by Friday | The Record from Recorded Future NewsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

CISA Orders Patching of Exploited SolarWinds Web Help Desk RCE (CVE-2025-40551)

How this story unfolded

CISA orders federal agencies to patch SolarWinds WHD by February 6

CISA adds CVE-2025-40551 and three other flaws to the KEV catalog

SolarWinds releases Web Help Desk 2026.1 to patch CVE-2025-40551

Horizon3.ai reports SolarWinds WHD flaw CVE-2025-40551 to SolarWinds

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

CISA Flags Actively Exploited SolarWinds Web Help Desk Flaw as Metasploit Adds Exploit Modules

Critical RCE and Authentication Bypass Vulnerabilities in SolarWinds Web Help Desk

Active Exploitation of SolarWinds Web Help Desk Insecure Deserialization (CVE-2025-26399)

CISA Orders Patching of Exploited SolarWinds Web Help Desk RCE (CVE-2025-40551)

How this story unfolded

CISA orders federal agencies to patch SolarWinds WHD by February 6

CISA adds CVE-2025-40551 and three other flaws to the KEV catalog

SolarWinds releases Web Help Desk 2026.1 to patch CVE-2025-40551

Horizon3.ai reports SolarWinds WHD flaw CVE-2025-40551 to SolarWinds

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

CISA Flags Actively Exploited SolarWinds Web Help Desk Flaw as Metasploit Adds Exploit Modules

Critical RCE and Authentication Bypass Vulnerabilities in SolarWinds Web Help Desk

Active Exploitation of SolarWinds Web Help Desk Insecure Deserialization (CVE-2025-26399)