CVE-2025-40536

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

81.62% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2026-02-12

Nuclei

high · CWE-693

Published

2026-01-28

Updated

2026-02-26

Proof-of-concept exploits (1)

• https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40536.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/solarwinds_webhelpdes…

References

• CVE Record
• NVD entry

Related

• CVE-2025-4039
• CVE-2025-40551
• CVE-2025-4038
• CVE-2025-40552
• CVE-2025-4037
• CVE-2025-40553