CVE-2025-40551

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

SolarWinds — Web Help Desk

Added to KEV catalog: 3 February 2026
Federal remediation due date: 6 February 2026
Weakness classification (CWE): CWE-502

CISA Description

SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40551 ; https://nvd.nist.gov/vuln/detail/CVE-2025-40551

View on NVD View on MITRE CVE View full CISA catalog

More SolarWinds Vulnerabilities

CVE-2026-28318

SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability

CVE-2025-26399

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

CVE-2025-40536

SolarWinds Web Help Desk Security Control Bypass Vulnerability

CVE-2024-28987

SolarWinds Web Help Desk Hardcoded Credential Vulnerability

CVE-2024-28986

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services