[ CVE-2025-40551 · Published 28 Jan 2026 ]
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-02-03
- EPSS: 84% chance of exploitation in the next 30 days (higher than 100% of CVEs)
- Critical severity: CVSS 9.8
[ Description ]Official description
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
CISA: SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 6 Feb 2026): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.