This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] SolarWinds Web Help Desk fixes 6 vulnerabilities

SolarWinds fixes 6 vulnerabilities in Web Help Desk with version 2026.1. The most severe of them are described below; the rest can be found at [1]. The vulnerability CVE-2025-40551 has been added to the CISA Known Exploited Vulnerabilities catalog [2].

SolarWinds Web Help Desk - authentication bypass (CVE-2025-40552)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can perform actions and call methods that should be protected by authentication, through an authentication bypass vulnerability [3].

The vulnerability is present in product:

  • SolarWinds Web Help Desk; <=12.8.8 HF1

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 28. 1. 2025.

SolarWinds Web Help Desk - RCE (CVE-2025-40551, CVE-2025-40553)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can execute commands on the host machine through a vulnerability involving deserialization of untrusted data [4].

The vulnerability is present in product:

  • SolarWinds Web Help Desk; <= 12.8.8 HF1

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 28. 1. 2026.

SolarWinds Web Help Desk - authentication bypass (CVE-2025-40554)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can trigger specific actions in the application that should otherwise be protected by authentication, through an authentication bypass vulnerability [5].

The vulnerability is present in product:

  • SolarWinds Web Help Desk; <=12.8.8 HF1

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 28. 1. 2026.

By CESNET, z.s.p.o. Michaela Jarošová on 2. 2. 2026.

CESNET, z.s.p.o. Logo