Skip to main content
Mallory
CriticalCISA KEVExploited in the wildPublic exploit

Unauthenticated RCE in SolarWinds Web Help Desk Deserialization

IdentifiersCVE-2025-40551CWE-502· Deserialization of Untrusted Data

CVE-2025-40551 is a critical deserialization of untrusted data vulnerability in SolarWinds Web Help Desk (WHD). The flaw affects SolarWinds Web Help Desk 12.8.8 HF1 and all previous versions, and was fixed in WHD version 2026.1. According to the provided content, the issue allows untrusted serialized data to be processed in a way that can be abused by a remote attacker to achieve code execution on the underlying host. Exploitation does not require authentication. The vulnerability has been described by SolarWinds and downstream reporting as an unauthenticated Java deserialization issue leading to remote code execution, and it has been added to CISA’s Known Exploited Vulnerabilities catalog due to active exploitation in the wild.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can result in unauthenticated remote code execution on the SolarWinds Web Help Desk server, allowing arbitrary command execution on the host machine. This can lead to full compromise of the WHD instance and underlying system, deployment of remote management or command-and-control tooling, credential theft, persistence, lateral movement, and broader compromise of connected enterprise environments. The content also indicates active exploitation in the wild and observed post-compromise activity including use of RMM tools, Velociraptor, Cloudflare Tunnel, credential dumping, and movement toward high-value assets.

Mitigation

If you can’t patch tonight, do this now.

Until patching is completed, remove or strictly limit public internet exposure of SolarWinds Web Help Desk, especially administrative interfaces, by placing the service behind a firewall or VPN and restricting access paths. Increase monitoring for suspicious child processes from WHD components, unexpected remote management tools, Velociraptor, Cloudflare Tunnel/cloudflared, scheduled-task persistence, credential-dumping activity, and anomalous outbound connections. Rotate WHD service, administrator, and any reachable downstream credentials after patching, and evict unauthorized RMM/C2 tooling if compromise is suspected. Patching prevents future exploitation but does not remediate prior compromise.

Remediation

Patch, then assume compromise.

Upgrade SolarWinds Web Help Desk to version 2026.1 or later, which SolarWinds states remediates CVE-2025-40551 along with related WHD vulnerabilities. Organizations running affected versions, including 12.8.8 HF1 and earlier, should urgently patch internet-exposed systems. Because the vulnerability is reported as actively exploited, remediation should also include incident response actions to determine whether compromise occurred prior to patching.
PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
SolarWindsWeb Help Deskapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware8

Malware families riding this exploit, with evidence and IOCs.

Detection signatures2

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity95

Community discussion across Reddit, Mastodon, and other social sources.