CVE-2025-40551: SolarWinds Web Help Desk unauthenticated deserialization RCE
The short version: SolarWinds Web Help Desk has an untrusted-data deserialization flaw (CVE-2025-40551) that lets an unauthenticated attacker run commands on the host. It's in CISA's KEV catalog — with a very short remediation window — and the fix is in the 2026.1 release. If you run an internet-facing Web Help Desk, patch and verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (see below) |
| CVSS v3.1 (NVD) | Unknown at time of writing — NVD record awaiting analysis |
| CVSS (SolarWinds, CNA) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 84.13% · 99.67th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2026-02-06 |
| Known exploited? | Yes — listed as a known-exploited vulnerability |
| Vulnerability type | CWE-502 deserialization of untrusted data → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | SolarWinds Web Help Desk 12.8.8 HF1 and below |
| Fixed in | Web Help Desk 2026.1 |
What you need to know
The flaw is unsafe deserialization of attacker-supplied data. Without authenticating, an attacker sends crafted serialized input that the application turns into attacker-controlled objects, leading to command execution on the host.
- It's pre-authentication and ends in RCE — the worst combination for an edge-facing service.
- It fits a pattern. Web Help Desk has seen a run of deserialization RCEs; this is another, and attackers watch this product closely.
- CISA moved fast. The KEV remediation window was very short, which signals confirmed exploitation and real urgency; EPSS sits near the top.
How serious we see it
High — the practical case is clear.
Unauthenticated remote code execution on a help-desk server that commonly sits at the network edge, confirmed in KEV, is top-of-queue by any honest measure. As with its sibling deserialization bugs, NVD hasn't posted its own score yet, so the CVSS above is SolarWinds' as the CNA — but that doesn't change the picture. The bounded, reassuring part is that it's specific and fixed: a defined version line and a published release. Patch, then verify — actively exploited flaws make "patched" and "clean" separate questions.
Recommendations
Straight from SolarWinds' advisory and CISA:
- Patch now. Upgrade Web Help Desk to 2026.1 or later.
- Restrict exposure. Keep Web Help Desk off the open internet where possible; limit to trusted networks or a VPN.
- Hunt. Given in-the-wild use, review for anomalous processes, outbound connections, and web-shell artifacts on the host.
- If compromised, respond fully. Rebuild where warranted and rotate credentials, keys, and secrets reachable from the host.
- Confirm your exposure first. Verify whether you run an internet-facing Web Help Desk and which version.
How BreachRisk sees it
BreachRisk works this from the outside in. From little more than your domain it discovers internet-facing SolarWinds Web Help Desk, fingerprints the version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one, surfaced at the top because it's in KEV. We identify and flag the affected version; we don't exploit it. The continuous, attacker's-eye view means an exposed, unpatched Web Help Desk is already mapped when an unauthenticated RCE lands and the clock is short.