CVE Intelligence
Analysis AI-assisted

CVE-2025-40553: SolarWinds Web Help Desk: untrusted data deserialization leading to RCE

CVE-2025-40553 affects SolarWinds Web Help Desk versions before 2026.1 and is classified as deserialization of untrusted data (CWE-502). The CVSS 3.1 score provided by the CNA is 9.8 (critical), and the record states that exploitation could occur without authentication to run commands on the host. CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2025-40553 is a deserialization of untrusted data weakness (CWE-502) in SolarWinds Web Help Desk. According to the record, it could lead to remote code execution, allowing commands to run on the host machine. The record shows publication on 2026-01-28 and cites the vendor's security advisory as the primary source.

Impact

  • Confirmed: the record describes remote code execution on the host machine.
  • Confirmed: the record states that exploitation could occur without authentication.
  • Confirmed: the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network access, low complexity, no privileges or user interaction, and high impact on confidentiality, integrity and availability.
  • Inference: a successful attack would likely run with the privileges of the Web Help Desk service, but the record does not state the privilege level.

Affected products and versions

  • Product: SolarWinds Web Help Desk.
  • Range listed in the record: versions before 2026.1.
  • The record's fixes list is empty. The vendor release notes for 2026.1 are cited, so consult them and the vendor advisory for exact build details.

Exploitation status

  • The record shows the CVE is not listed in CISA KEV, and no EPSS score is available.
  • No confirmed exploitation appears in the sources consulted.
  • Absence of KEV listing does not mean absence of risk. An unauthenticated critical flaw in a help desk platform that may be reachable from user networks warrants prompt prioritization.

Remediation and mitigation

  • Apply the vendor update to version 2026.1 or later, following the release notes.
  • If the update cannot be applied immediately, reduce exposure: restrict access to the Web Help Desk interface to trusted networks and hosts, and verify that it is not reachable from the internet.
  • Review the vendor advisory for any additional guidance.

Detection guidance

  • Review web server and application logs for unexpected or unusual requests to the Web Help Desk interface, especially from unknown sources.
  • Monitor the server for unexpected child processes or command activity originating from the Web Help Desk service.
  • Watch for unexpected outbound connections from the server, which can indicate post-compromise activity.

Limitations of the available information

  • The record does not list specific fixed build numbers beyond the affected range and the 2026.1 release notes.
  • No KEV, EPSS or SSVC data is available in the record.
  • Technical details of the vulnerable component are not included in the record.
  • Whether affected instances are exposed to the internet in your environment is unknown.

Frequently asked questions

Is CVE-2025-40553 being actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted. The absence of exploitation data does not reduce the need to patch a critical unauthenticated flaw.

Which versions of SolarWinds Web Help Desk are affected?

The record lists versions before 2026.1 as affected. Check the vendor advisory and release notes for exact build details.

What is the first step to reduce risk?

Update to 2026.1 or later. If that is not possible right away, restrict access to the Web Help Desk interface to trusted networks.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.