CVE-2025-40536

SolarWinds Web Help Desk Security Control Bypass Vulnerability

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.

Affected

SolarWinds · Web Help Desk

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 SOLARWINDS

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

73.56% chance of exploitation in the next 30 days, 99th percentile

CISA KEV

added 2026-02-12

Nuclei

high · CWE-693

Published

2026-01-28

Updated

2026-02-26

Proof-of-concept exploits (1)

• https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40536.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/solarwinds_webhelpdes…

Security advisories

• https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40536
• https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026…

References

• CVE Record
• NVD entry