Not scored
CVE-2025-40553
SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
SolarWindsWeb Help Desk
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
68%probability of exploitation in the next 30 days
Higher than 99% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
Coverage 6 articles · 5 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 28 Jan · 11:20 UTC | SecurityOnline | SolarWinds Web Help Desk Hit with Multiple RCE and Auth Bypass Vulnerabilities |
| Thu 29 Jan · 10:00 UTC | The Hacker News | SolarWinds Fixes Four Critical Web Help Desk Flaws With Unauthenticated RCE and Auth Bypass |
| Thu 29 Jan · 13:51 UTC | SecurityWeek | SolarWinds Patches Critical Web Help Desk Vulnerabilities |
| Thu 29 Jan · 20:51 UTC | Security Affairs | SolarWinds addressed four critical Web Help Desk flaws |
| Fri 30 Jan · 09:16 UTC | SOCRadar | SolarWinds Web Help Desk Update Addresses High-Risk RCE & Auth Bypass Bugs |
| Wed 4 Feb · 07:36 UTC | The Hacker News | CISA Adds Actively Exploited SolarWinds Web Help Desk RCE to KEV Catalog |
- CISA Adds Actively Exploited SolarWinds Web Help Desk RCE to KEV CatalogThe Hacker News · mentions it in passing
- SolarWinds Web Help Desk Update Addresses High-Risk RCE & Auth Bypass BugsSOCRadar · mentions it in passing
- SolarWinds addressed four critical Web Help Desk flawsSecurity Affairs · mentions it in passing
- SolarWinds Patches Critical Web Help Desk VulnerabilitiesSecurityWeek · mentions it in passing
- SolarWinds Fixes Four Critical Web Help Desk Flaws With Unauthenticated RCE and Auth BypassThe Hacker News · mentions it in passing
- SolarWinds Web Help Desk Hit with Multiple RCE and Auth Bypass VulnerabilitiesSecurityOnline · first in our coverage · mentions it in passing