CVE-2025-40551: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
Other sources
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SolarWinds Web Help Deskto a version that resolves this vulnerability.Fixed in 2026.1 - Remove
Remove
SolarWinds Web Help Deskfrom your environment.Discontinue use or uninstall the product if mitigations are unavailable.
- Compensating control
Apply mitigations per vendor instructions and follow applicable BOD 22-01 guidance for cloud services.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40551?
CVE-2025-40551 is considered critical due to its potential for remote code execution.
How do I fix CVE-2025-40551?
To fix CVE-2025-40551, upgrade to the latest version of SolarWinds Web Help Desk as specified in their security advisory.
What kind of attack does CVE-2025-40551 allow?
CVE-2025-40551 allows attackers to perform remote code execution by exploiting a deserialization vulnerability.
Which products are affected by CVE-2025-40551?
CVE-2025-40551 affects the SolarWinds Web Help Desk software.
Is CVE-2025-40551 being actively exploited?
Yes, there are indications that CVE-2025-40551 is being actively exploited in the wild.