CVE-2025-40554

Published Jan 28, 2026

Last updated 3 months ago

SolarWinds Web Help Desk

Supply chain

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-40554 is an authentication bypass vulnerability found in SolarWinds Web Help Desk (WHD). This flaw allows an attacker to invoke specific internal actions within the WHD platform without proper authorization. Successful exploitation of CVE-2025-40554 could lead to unauthorized access to sensitive functionality within the Web Help Desk system. Some reports indicate that this authentication bypass could potentially be leveraged to achieve remote code execution (RCE).

Description: SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.
Source: psirt@solarwinds.com
NVD status: Analyzed
Products: web_help_desk

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@solarwinds.com: CWE-1390

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "F7CADB33-214C-441A-BB62-64811EBBEB29",
            "versionEndExcluding": "2026.1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.