Critical severity9.8NVD Advisory· Published Jan 28, 2026· Updated Jun 17, 2026

CVE-2025-40554

Description

SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

SolarWinds/WebHelpDesk3 versions
cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*range: <2026.1
- (no CPE)
- (no CPE)range: 12.8.8 HF1 and below

Patches

Vulnerability mechanics

References

www.solarwinds.com/trust-center/security-advisories/CVE-2025-40554nvdVendor Advisory
documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htmnvdRelease Notes

News mentions

Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s))
watchTowr Labs · Feb 25, 2026

cvss	0.637
epss	0.047
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000