CVE Watch—

CVE-2025-40551

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

CVSS

—

No CVSS

EPSS

84.1%

p100

KEV

YES

Feb 3, 2026

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

84.1%EPSS · 30 days84.1%

2026-06-302026-07-16

KEV catalog record

Product

SolarWinds / Web Help Desk

Vulnerability

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Added to KEV

Feb 3, 2026

Remediate by

Feb 6, 2026

Known ransomware use

Summary description

SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40551 ; https://nvd.nist.gov/vuln/detail/CVE-2025-40551

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2024-28987—

99.8%

KEV—80SolarWinds Web Help Desk Hardcoded Credential Vulnerability—CVE-2025-26399—

99.8%

KEV—80SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability—CVE-2024-28986—

99.7%

KEV—80SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability—CVE-2025-40536—

99.6%

KEV—80SolarWinds Web Help Desk Security Control Bypass Vulnerability—