CVE Intelligence
Analysis AI-assisted

CVE-2025-40554: SolarWinds Web Help Desk Authentication Bypass

SolarWinds Web Help Desk is affected by an authentication bypass vulnerability tracked as CVE-2025-40554, which could allow an attacker to invoke specific actions within the application. The CNA scores it as critical with CVSS 3.1 9.8. The record lists versions below 2026.1 as affected and does not show confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

SolarWinds Web Help Desk is affected by an authentication bypass vulnerability tracked as CVE-2025-40554. According to the record description, an attacker exploiting it could invoke specific actions within the application. SolarWinds acts as the CNA and scores the issue as critical, with CVSS 3.1 9.8.

Impact

  • The CNA vector describes a network-reachable attack with low complexity, no privileges required and no user interaction.
  • The same vector reports high impact on confidentiality, integrity and availability.
  • The record does not specify which actions could be invoked, so the precise business impact is unknown.

Affected products and versions

  • Product: SolarWinds Web Help Desk.
  • Affected range in the record: versions below 2026.1.
  • The record has no populated fixed-version field. It references the 2026.1 release notes, which suggests but does not explicitly confirm that 2026.1 contains the fix.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog, so it is not marked there as actively exploited. No confirmed exploitation appears in the sources consulted. EPSS and SSVC data are absent from the record.

Remediation and mitigation

  • Review the SolarWinds security advisory and the Web Help Desk 2026.1 release notes to confirm the fixed build for your deployment.
  • Plan upgrades of instances older than 2026.1 following vendor guidance, testing first in a non-production environment.
  • While patching, restrict network access to Web Help Desk interfaces to trusted networks as a general defensive measure.
  • Maintain an inventory of Web Help Desk instances and their installed versions.

Detection guidance

  • Review web server and application logs for unexpected requests reaching action endpoints without a valid authenticated session.
  • Monitor for unusual administrative actions or configuration changes in the application.
  • Correlate application logs with network telemetry to spot access from unexpected sources.

Limitations of the available information

  • The record does not name the specific actions or endpoints involved.
  • The CWE name is not provided; only the identifier CWE-1390 appears.
  • No EPSS score or SSVC decision is available.
  • The vendor advisory body was not included in the record, so details beyond the description are unknown.

Frequently asked questions

What is CVE-2025-40554?

It is an authentication bypass vulnerability in SolarWinds Web Help Desk that could allow an attacker to invoke specific actions within the application, according to the record description.

Which versions are affected?

The record lists versions below 2026.1 as affected. Confirm the exact fixed build against the vendor advisory and release notes.

Is this CVE known to be actively exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.