CVE-2025-40551
Published 2026-01-28 · Updated 2026-06-17 · Source psirt@solarwinds.com
Summary
CVE-2025-40551 is a critical-severity (CVSS 9.8) vulnerability in SolarWinds Web Help Desk. CISA added it to the Known Exploited Vulnerabilities catalog on February 3, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by February 6, 2026. CISA does not currently list it as used in ransomware campaigns. SolarWinds has 11 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.
All 11 known-exploited SolarWinds vulnerabilities →Description
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: SolarWinds — Web Help Desk
Name: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
Date added: 2026-02-03 · Due: 2026-02-06
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.