CVE-2025-40551

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

83.62% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2026-02-03

Nuclei

critical · CWE-502

Published

2026-01-28

Updated

2026-02-26

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40551.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/solarwinds_webhelpdes…

References

• CVE Record
• NVD entry

Related

• CVE-2025-40536
• CVE-2025-40552
• CVE-2025-4039
• CVE-2025-40553
• CVE-2025-4038
• CVE-2025-40554