Vulnerability intelligence

CVE-2025-40536

SolarWinds Web Help Desk Security Control Bypass Vulnerability

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.

CVSS Score

8.1

High

EPSS — Exploit Probability

74%

Riskier than 99% of all CVEs · checked 2026-10-06

Exploitation

Confirmed in the wild

KEV since 2026-02-12

Remediation

Unconfirmed

Federal deadline 2026-02-15

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-02-15.

NVD entry CISA KEV

13 articles across 5 outlets · first covered Jan 28, 2026 · latest Feb 13, 2026

Coverage timeline

CISA Warns of Exploited SolarWinds, Notepad++, Microsoft Vulnerabilities
www.securityweek.com · Feb 13, 2026
Researchers Observe In-the-Wild Exploitation of BeyondTrust CVSS 9.9 Vulnerability
thehackernews.com · Feb 13, 2026
U.S. CISA adds SolarWinds Web Help Desk, Notepad++, Microsoft Configuration Manager, and Apple devices flaws to its Known Exploited Vulnerabilities catalog
securityaffairs.com · Feb 13, 2026
Virtual Invasion: SolarWinds WHD Exploited to Host Hidden QEMU VMs
securityonline.info · Feb 10, 2026
SolarWinds Web Help Desk Exploited for RCE in Multi-Stage Attacks on Exposed Servers
thehackernews.com · Feb 9, 2026
Attackers abuse SolarWinds Web Help Desk to install Zoho agents and Velociraptor
securityaffairs.com · Feb 9, 2026
Recent SolarWinds Flaws Potentially Exploited as Zero-Days
www.securityweek.com · Feb 9, 2026
CISA Adds Actively Exploited SolarWinds Web Help Desk RCE to KEV Catalog
thehackernews.com · Feb 4, 2026
SolarWinds Web Help Desk Update Addresses High-Risk RCE & Auth Bypass Bugs
socradar.io · Jan 30, 2026
SolarWinds addressed four critical Web Help Desk flaws
securityaffairs.com · Jan 29, 2026
SolarWinds Patches Critical Web Help Desk Vulnerabilities
www.securityweek.com · Jan 29, 2026
SolarWinds Fixes Four Critical Web Help Desk Flaws With Unauthenticated RCE and Auth Bypass
thehackernews.com · Jan 29, 2026
SolarWinds Web Help Desk Hit with Multiple RCE and Auth Bypass Vulnerabilities
securityonline.info · Jan 28, 2026

Related CVEs — SolarWinds

CVE-2026-28324 CVE-2026-28325 CVE-2026-28326 CVE-2026-28307 CVE-2026-28308 CVE-2026-28321 CVE-2026-28318KEV CVE-2025-26399KEV