Critical severity · published Jan 28, 2026
CVE-2025-40554
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web…
9.8
CVSS
60.6%
EPSS
No
On KEV
Description
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)60.6% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WH
Web Help Desk · Solarwinds
before 2026.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-40554
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-40554
Release Notes
https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
Vendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40554
More from Web Help Desk
9.8
CVE-2025-40551
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
9.8
CVE-2025-40536
SolarWinds Web Help Desk Security Control Bypass Vulnerability
9.8
CVE-2025-26399
SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability
9.8
CVE-2024-28986
SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability
9.1
CVE-2024-28987
SolarWinds Web Help Desk Hardcoded Credential Vulnerability