CVE-2025-40551

9.8 CRITICAL CISA KEV - Actively Exploited
Published: January 28, 2026 Modified: February 04, 2026
View on NVD

Description

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
Source: psirt@solarwinds.com
Release Notes
https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40551
Source: psirt@solarwinds.com
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40551
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

3 reference(s) from NVD

Quick Stats

CVSS v3 Score
9.8 / 10.0
EPSS (Exploit Probability)
80.6%
99th percentile
Exploitation Status
Actively Exploited
Remediation due: 2026-02-06

Weaknesses (CWE)

CWE-502

Affected Vendors

solarwinds

Related CVEs

CVE-2026-4472 6.3
CVE-2026-4471 4.7
CVE-2026-4470 4.7
CVE-2026-4469 4.7
CVE-2026-33035 N/A