CVE-2025-40551

Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk versions prior to 2026.1 SolarWinds Web Help Desk versions 12.8.8 HF1 and earlier

Description SolarWinds Web Help Desk is susceptible to an untrusted data deserialization vulnerability that allows attackers to execute commands on the host machine without authentication. This vulnerability, designated CVE-2025-40551, is actively being exploited and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. The vulnerability resides in the AjaxProxy component. Over 170 installations are reportedly exposed online. The vulnerability allows for remote code execution (RCE).

Recommendations SolarWinds Web Help Desk versions prior to 2026.1: Update to version 2026.1 immediately. SolarWinds Web Help Desk versions 12.8.8 HF1 and earlier: Update to version 2026.1 immediately.