Active Exploitation of SolarWinds Web Help Desk Flaws Enables Remote Code Execution
Active Exploitation · 8 sources · Updated 2mo ago · First seen May 25, 2026
SolarWinds warned that multiple vulnerabilities in Web Help Desk are being actively exploited, with reporting highlighting a critical flaw that can lead to remote code execution on exposed help-desk servers. Public references tie the activity to CVE-2025-40554, while additional SolarWinds advisories and third-party research point to related issues including CVE-2025-40552, CVE-2025-40553, and CVE-2025-40536, indicating a broader security problem affecting the product.
Security researchers and defenders published proof-of-concept material and detection guidance shortly after disclosure, including a watchTowr repository focused on Web Help Desk exploitation and a GitHub Gist describing uncommon process activity associated with compromise. The combination of vendor advisories, media reporting, and public exploit research indicates that attackers moved quickly to weaponize the flaws, increasing risk for organizations that have not patched, isolated, or monitored SolarWinds Web Help Desk deployments.
