Source: The Hacker News
SolarWinds has released critical security updates for its Web Help Desk platform, addressing six severe vulnerabilities – four of which carry critical severity ratings. These flaws could allow attackers to bypass authentication and achieve remote code execution (RCE) without any credentials.
The Critical Vulnerabilities
The most severe issues include:
- CVE-2025-40551 (CVSS 9.8) – An untrusted data deserialization vulnerability enabling unauthenticated remote code execution
- CVE-2025-40552 (CVSS 9.8) – An authentication bypass allowing attackers to execute actions and methods without credentials
- CVE-2025-40553 (CVSS 9.8) – Another deserialization flaw leading to RCE on the host machine
- CVE-2025-40554 (CVSS 9.8) – Authentication bypass enabling specific action invocation within Web Help Desk
- CVE-2025-40536 (CVSS 8.1) – Security control bypass granting access to restricted functionality
- CVE-2025-40537 (CVSS 7.5) – Hard-coded credentials allowing admin function access via the client user account
Why This Matters
Security researchers from Horizon3.ai and watchTowr discovered these vulnerabilities. According to Rapid7 analysis, the deserialization vulnerabilities (CVE-2025-40551 and CVE-2025-40553) are highly reliable vectors for attackers to leverage, and because they do not require authentication, the potential impact is significant.
SolarWinds Web Help Desk has a history of security issues. In late 2024, CISA added CVE-2024-28986 and CVE-2024-28987 to its Known Exploited Vulnerabilities catalog due to active exploitation in the wild. This pattern suggests threat actors actively target this platform.
Immediate Action Required
Organizations running SolarWinds Web Help Desk should immediately update to version WHD 2026.1. Given the critical nature of these flaws and the history of exploitation targeting this software, delayed patching significantly increases risk exposure.
Key takeaways for defenders:
- Patch immediately – all six vulnerabilities are addressed in WHD 2026.1
- Monitor for exploitation attempts against Web Help Desk instances
- Review network segmentation around help desk systems
- Consider the broader attack surface of IT service management tools
