CVE-2025-40554

SolarWinds Web Help Desk Authentication Bypass Vulnerability

SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.

Affected

SolarWinds · Web Help Desk

CVSS v3.1 SOLARWINDS

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

60.64% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-1390

Published

2026-01-28

Updated

2026-02-26

Proof-of-concept exploits (2)

• Skynoxk/CVE-2025-405540★ · 2026-02-02
• imbas007/auth-bypass-CVE-2025-405541★ · 2026-01-29

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40554.yaml

Security advisories

• https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40554
• https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026…

References

• CVE Record
• NVD entry

Related

• CVE-2025-48703
• CVE-2026-27944
• CVE-2022-36804
• CVE-2025-24813
• CVE-2025-25257
• CVE-2025-3248