CISA Flags Actively Exploited SolarWinds Web Help Desk Flaw as Metasploit Adds Exploit Modules
Active Exploitation · 4 sources · Updated 4mo ago · First seen Feb 14, 2026
CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including a critical SolarWinds Web Help Desk (WHD) security protection bypass tracked as CVE-2025-40536 (CVSS 9.8). The issue stems from flawed CSRF-check logic that relies on a whitelist of query parameters, which can be bypassed with crafted URI parameters to reach restricted functionality without authentication; SolarWinds patched the flaw in WHD 2026.1. CISA set an accelerated remediation deadline for U.S. Federal Civilian Executive Branch agencies, and Microsoft separately reported an active campaign targeting SolarWinds WHD but did not confirm whether CVE-2025-40536 was the specific vulnerability exploited.
Rapid7 reported that Metasploit added exploit module support for SolarWinds WHD vulnerabilities CVE-2025-40536 and CVE-2025-40551, enabling post-exploitation sessions running as NT AUTHORITY\SYSTEM when successful. This increases operational risk for unpatched environments by lowering the barrier to exploitation and reinforces the urgency of applying SolarWinds’ available fixes and validating exposure of WHD instances, particularly those reachable from untrusted networks.
