CVE-2025-40552: SolarWinds Web Help Desk Authentication Bypass
CVE-2025-40552 is a critical authentication bypass in SolarWinds Web Help Desk. According to the record, an attacker could reach actions and methods that should be protected by authentication. The CVSS 3.1 base score of 9.8 is attributed to the CNA, and the listed affected range is versions before 2026.1. The record does not show KEV listing, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2025-40552 is an authentication bypass in SolarWinds Web Help Desk. The record describes it as allowing a malicious actor to execute actions and methods that should be protected by authentication. The record assigns it CWE-1390.
Impact
The record states that successful exploitation would expose functions that normally require authentication. The CVSS 3.1 vector indicates a network-reachable attack with low complexity, no privileges required, no user interaction, and high impact to confidentiality, integrity and availability, which yields a base score of 9.8 according to the record. Real impact depends on how the help desk is deployed and what data it holds.
Affected products and versions
- Product: SolarWinds Web Help Desk
- Versions: listed as earlier than 2026.1
The record does not list a fixed version explicitly. Its reference to the 2026.1 release notes suggests the fix is included in that release, but this is an inference to confirm with the vendor.
Exploitation status
The record shows that this CVE is not listed in the CISA KEV catalog and has no EPSS score. No confirmed active exploitation appears in the sources consulted. The record also references a third-party public repository; its contents were not evaluated here, and its presence does not by itself establish exploitation.
Remediation and mitigation
- Confirm the installed version against the vendor security advisory.
- Plan an upgrade to 2026.1 or later, following the 2026.1 release notes.
- Until patched, limit network exposure of the help desk interface to trusted networks and administrative paths.
- The record does not describe interim workarounds; check the vendor advisory for any official guidance.
Detection guidance
- Review web application and authentication logs for access to administrative or sensitive functions from unexpected sources.
- Look for account creation, configuration changes or administrative actions that were not authorized.
- Keep logs centralized and retained long enough to support investigation.
Limitations of the available information
The record has no explicit fixed build number, no CWE name, no EPSS or SSVC data, and no detail on which specific functions are affected. The affected range is given only as versions before 2026.1. This analysis relies only on the sources listed in the record.
Frequently asked questions
Is CVE-2025-40552 being actively exploited?
The record does not list this CVE in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.
Which versions are affected?
The record lists SolarWinds Web Help Desk versions earlier than 2026.1 as affected.
What should administrators do now?
Confirm the installed version against the vendor advisory, plan an upgrade to 2026.1 or later, and limit network exposure until the fix is applied.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.