CVE-2025-40553

SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

Affected

SolarWinds · Web Help Desk

CVSS v3.1 SOLARWINDS

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

67.97% chance of exploitation in the next 30 days, 99th percentile

Published

2026-01-28

Updated

2026-02-27

Proof-of-concept exploits (1)

• watchtowrlabs/watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-405534★ · 2026-02-13

Security advisories

• https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40553
• https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026…

References

• CVE Record
• NVD entry