By 
SolarWinds has released security updates to fix multiple vulnerabilities affecting its Web Help Desk (WHD) platform, including four critical flaws that could allow authentication bypass and remote code execution (RCE).
The patched vulnerabilities include:
- CVE-2025-40536 (CVSS 8.1) – A security control bypass that could let an unauthenticated attacker access restricted functionality
- CVE-2025-40537 (CVSS 7.5) – A hard-coded credentials flaw enabling access to administrative features using the “client” account
- CVE-2025-40551 (CVSS 9.8) – An untrusted deserialization issue that could allow unauthenticated RCE on the host system
- CVE-2025-40552 (CVSS 9.8) – An authentication bypass that could permit unauthenticated execution of actions and methods
- CVE-2025-40553 (CVSS 9.8) – Another untrusted deserialization vulnerability leading to unauthenticated RCE
- CVE-2025-40554 (CVSS 9.8) – An authentication bypass allowing attackers to invoke specific WHD actions
Horizon3.ai researcher Jimi Sebree discovered and reported the first three vulnerabilities, while watchTowr researcher Piotr Bazydlo was credited with identifying the remaining issues. All flaws have been resolved in Web Help Desk version 2026.1.
Rapid7 highlighted that CVE-2025-40551 and CVE-2025-40553 are especially dangerous, as deserialization-based RCE is a reliable attack vector and does not require authentication. The firm also noted that the authentication bypass flaws (CVE-2025-40552 and CVE-2025-40554) could potentially be chained to achieve RCE, resulting in the same level of impact.
SolarWinds has addressed several Web Help Desk vulnerabilities in recent years, including CVE-2024-28986, CVE-2024-28987, CVE-2024-28988, and CVE-2025-26399. Notably, CVE-2025-26399 fixed a patch bypass for CVE-2024-28988, which itself bypassed a fix for CVE-2024-28986. In late 2024, CISA added CVE-2024-28986 and CVE-2024-28987 to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation.
Explaining CVE-2025-40551, Sebree described it as another deserialization flaw in the AjaxProxy functionality. Exploitation involves establishing a valid session, manipulating the LoginPref component, abusing the JSON-RPC bridge to create malicious Java objects, and triggering them to achieve RCE.
Given the history of active exploitation targeting Web Help Desk, SolarWinds customers are strongly advised to upgrade to the latest version as soon as possible.
