CVE-2025-40551

SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

Affected

SolarWinds · Web Help Desk

CVSS v3.1 SOLARWINDS

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

84.18% chance of exploitation in the next 30 days, 100th percentile

CISA KEV

added 2026-02-03

Nuclei

critical · CWE-502

Published

2026-01-28

Updated

2026-10-07

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40551.yaml

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/solarwinds_webhelpdes…

Security advisories

• https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40551
• https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026…

References

• CVE Record
• NVD entry