CVE-2025-40551: SolarWinds Web Help Desk untrusted data deserialization

CVE-2025-40551 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-02-03

SolarWinds Web Help Desk, a popular IT service management and ticketing platform, contains a critical security flaw that allows unauthorized individuals to take full control of the server. By sending a specially crafted request, an attacker can execute arbitrary commands on the host machine without needing any login credentials. This could lead to the complete theft of sensitive support tickets, customer data, and a total disruption of IT operations. This vulnerability is currently being exploited in the wild.

Technologies: SolarWinds Web Help Desk. Vendors: SolarWinds.

Quick answers

Is CVE-2025-40551 exploited in the wild?
Yes. CVE-2025-40551 is known to be exploited in the wild, first recorded on 3 February 2026. Treat it as urgent.
How severe is CVE-2025-40551?
Critical severity, with a CVSS score of 9.8, published 3 February 2026.
Which products and versions are affected?
SolarWinds Web Help Desk Versions prior to 2026.1.
Is there a fix for CVE-2025-40551?
A patch was published on 2026-02-03: Fix available in version 2026.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-40551 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-40551?
Check whether you run SolarWinds Web Help Desk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A deserialization of untrusted data vulnerability (CWE-502) exists in SolarWinds Web Help Desk. The flaw allows an unauthenticated attacker to send malicious serialized objects over the network, which the application then processes without sufficient validation. Successful exploitation results in remote code execution (RCE) with the privileges of the application service. This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. Users should update to version 2026.1 or later to remediate the issue.

Affected products

  • SolarWinds Web Help Desk Versions prior to 2026.1

Timeline

  • 2026-01-28: disclosed: Initial CVE entry received from SolarWinds
  • 2026-02-03: advisory: NVD and SolarWinds published full advisory details
  • 2026-02-03: kev added: CISA added the vulnerability to the Known Exploited Vulnerabilities catalog
  • 2026-02-03: patched: Fix available in version 2026.1

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.