Loading story…
CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including a critical SolarWinds Web Help Desk (WHD) security protection bypass tracked as CVE-2025-40536 (CVSS 9.8). The issue stems from flawed CSRF-check logic that relies on a whitelist of query parameters, which can be bypassed with crafted URI parameters to reach restricted functionality without authentication; SolarWinds patched the flaw in WHD 2026.1. CISA set an accelerated remediation deadline for U.S. Federal Civilian Executive Branch agencies, and Microsoft separately reported an active campaign targeting SolarWinds WHD but did not confirm whether CVE-2025-40536 was the specific vulnerability exploited.
Rapid7 reported that Metasploit added exploit module support for SolarWinds WHD vulnerabilities CVE-2025-40536 and CVE-2025-40551, enabling post-exploitation sessions running as NT AUTHORITY\SYSTEM when successful. This increases operational risk for unpatched environments by lowering the barrier to exploitation and reinforces the urgency of applying SolarWinds’ available fixes and validating exposure of WHD instances, particularly those reachable from untrusted networks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Under Binding Operational Directive 22-01, CISA required FCEB agencies to remediate the newly added vulnerabilities by set deadlines: February 15, 2026 for CVE-2025-40536 and March 5, 2026 for the other three flaws.
CISA added CVE-2024-43468, CVE-2025-15556, CVE-2025-40536, and CVE-2026-20700 to its Known Exploited Vulnerabilities catalog, signaling active exploitation affecting Microsoft Configuration Manager, Notepad++, SolarWinds Web Help Desk, and Apple devices.
Rapid7 published a Metasploit Framework update that included a new exploit module for SolarWinds Web Help Desk vulnerabilities CVE-2025-40536 and CVE-2025-40551, capable of yielding a session running as NT AUTHORITY\SYSTEM.
Google's Threat Analysis Group discovered and reported CVE-2026-20700 to Apple, indicating the flaw was identified during investigation of targeted exploitation that may be associated with nation-state or commercial spyware activity.
Apple released security updates across iOS, iPadOS, macOS, watchOS, tvOS, and visionOS to fix CVE-2026-20700, a dyld memory corruption and buffer overflow issue allowing arbitrary code execution. Apple said the flaw had been exploited in an extremely sophisticated targeted attack.
SolarWinds fixed CVE-2025-40536, a critical Web Help Desk security control bypass that can let attackers access restricted functions without authentication, in Web Help Desk version 2026.1.
Microsoft provided update KB29166583 to address CVE-2024-43468, a critical SQL injection vulnerability in Microsoft Configuration Manager that can be exploited unauthenticated against an internet-exposed endpoint and potentially escalated to remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcenews4hackers.com
Open sourcesecurityaffairs.com
Open sourcerapid7.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Cybersecurity and Infrastructure Security Agency (**CISA**) added **CVE-2025-40551**—a critical (CVSS 9.8) *SolarWinds Web Help Desk (WHD)* vulnerability—to its **Known Exploited Vulnerabilities (KEV)** catalog after confirming active exploitation. The flaw is described as **deserialization of untrusted data** that can enable **unauthenticated remote code execution**, potentially allowing full compromise of affected WHD servers; the issue was reported to SolarWinds by Horizon3.ai researcher **Jimi Sebree**. CISA also issued a directive requiring U.S. federal civilian agencies to patch CVE-2025-40551 by the stated deadline, and SolarWinds released a fix in *Web Help Desk* version **2026.1**. Reporting tied the bug to a prior WHD issue (**CVE-2024-28986**) and characterized CVE-2025-40551 as part of a sequence of vulnerabilities involving bypasses of earlier fixes; CISA’s KEV update also included additional exploited flaws in **Sangoma FreePBX** (including **CVE-2019-19006** and **CVE-2025-64328**) and **GitLab** (**CVE-2021-39935**, SSRF), expanding the set of vulnerabilities agencies must remediate under KEV timelines.
Jun 29, 2026
**CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog**, triggering mandatory remediation timelines for U.S. federal civilian agencies. The newly listed issues include an actively exploited flaw in **SolarWinds Web Help Desk** (`CVE-2025-40536`) with an accelerated patch deadline, alongside additional KEV additions affecting **Apple** platforms (iOS, macOS, tvOS, watchOS, visionOS), **Microsoft** products, and **Notepad++**. Apple stated it was aware of reports the issue “may have been exploited in an extremely sophisticated attack against specific targeted individuals,” with **Google Threat Analysis Group** credited with discovery, underscoring continued targeting of high-value users via mobile/endpoint zero-days. Separate reporting highlighted the broader operational context driving these directives: **Microsoft’s February security update** addressed **59 vulnerabilities**, including **six zero-days under active exploitation**, reinforcing that exploit timelines are compressing and patching is increasingly a “defense sprint.” In parallel, CISA also moved to reduce systemic exposure at the perimeter by ordering agencies to **remove unsupported network edge devices** (e.g., firewalls/routers) within a year, reflecting concern that end-of-support infrastructure and rapidly weaponized vulnerabilities are converging into a persistent, high-impact federal risk.
Jun 29, 2026
SolarWinds warned that multiple vulnerabilities in **Web Help Desk** are being actively exploited, with reporting highlighting a critical flaw that can lead to **remote code execution** on exposed help-desk servers. Public references tie the activity to `CVE-2025-40554`, while additional SolarWinds advisories and third-party research point to related issues including `CVE-2025-40552`, `CVE-2025-40553`, and `CVE-2025-40536`, indicating a broader security problem affecting the product. Security researchers and defenders published proof-of-concept material and detection guidance shortly after disclosure, including a watchTowr repository focused on Web Help Desk exploitation and a GitHub Gist describing **uncommon process activity** associated with compromise. The combination of vendor advisories, media reporting, and public exploit research indicates that attackers moved quickly to weaponize the flaws, increasing risk for organizations that have not patched, isolated, or monitored SolarWinds Web Help Desk deployments.
Jul 12, 2026