CVE-2025-40536
Published 2026-01-28 · Updated 2026-06-17 · Source psirt@solarwinds.com
Summary
CVE-2025-40536 is a high-severity (CVSS 8.1) vulnerability in SolarWinds Web Help Desk. CISA added it to the Known Exploited Vulnerabilities catalog on February 12, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by February 15, 2026. CISA does not currently list it as used in ransomware campaigns. SolarWinds has 11 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.
All 11 known-exploited SolarWinds vulnerabilities →Description
SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: SolarWinds — Web Help Desk
Name: SolarWinds Web Help Desk Security Control Bypass Vulnerability
Date added: 2026-02-12 · Due: 2026-02-15
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
References
- https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40536
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40536
- https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399