CVE-2025-40536
SolarWinds Web Help Desk Security Control Bypass Vulnerability
Description
CVE-2025-40536 is a high-severity security control bypass vulnerability in SolarWinds Web Help Desk, rated 8.1 on the CVSS v3.1 scale. The flaw allows an unauthenticated attacker to circumvent security mechanisms and gain access to restricted functionality within the application. With a network-based attack vector and no requirement for user interaction or privileges, the vulnerability poses a significant risk to organizations relying on Web Help Desk for IT service management. The exploit complexity is high, meaning successful exploitation requires specific conditions to be met, but the potential impact spans confidentiality, integrity, and availability. This vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 15, 2026, and carries an EPSS score of 0.66632 (98.50th percentile), indicating an exceptionally high probability of exploitation in the wild. Active exploitation has been observed, as reported by Huntress in their detailed analysis of Web Help Desk attacks. All versions prior to 2026.1 are affected.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| solarwinds | web help desk | < 2026.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm(Release Notes)
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40536(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40536(US Government Resource)
- https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399(Third Party Advisory)
Weakness Type
CWE-693: Protection Mechanism Failure
This vulnerability is classified under CWE-693: Protection Mechanism Failure, which describes situations where a product does not properly use or implement a security protection mechanism, or the mechanism itself has a design or implementation flaw that allows it to be bypassed. In the context of CVE-2025-40536, the security controls within SolarWinds Web Help Desk fail to adequately enforce access restrictions, enabling an unauthenticated attacker to reach functionality that should be protected behind authentication or authorization boundaries. Protection mechanism failures are particularly dangerous because they undermine the foundational trust assumptions of an application's security architecture.
Impact Analysis
The impact of CVE-2025-40536 is severe across all three security dimensions. Confidentiality is highly impacted because an attacker who bypasses security controls can access sensitive data stored within the help desk system, including support tickets, user credentials, internal communications, and potentially connected asset information. Integrity faces a high impact as unauthorized access to restricted functionality could allow an attacker to modify ticket data, alter configuration settings, create or elevate user accounts, or tamper with audit logs. Availability is also rated high because an attacker with access to administrative functionality could disrupt service operations, lock out legitimate users, or degrade system performance. The network-based attack vector (AV:N) means the vulnerability is exploitable remotely, dramatically increasing the pool of potential attackers. Although the attack complexity is high (AC:H), the fact that no privileges (PR:N) and no user interaction (UI:N) are required lowers the practical barrier to exploitation. Organizations using Web Help Desk in internet-facing deployments are at particular risk, especially given confirmed active exploitation reported by Huntress. The ransomware association is currently listed as unknown, but the nature of the access gained could readily facilitate ransomware deployment.
Exploit Maturity
This vulnerability has a very high exploitation maturity. CISA has added CVE-2025-40536 to its Known Exploited Vulnerabilities catalog, confirming that active exploitation has been observed in the wild. The EPSS score of 0.66632 places it in the 98.50th percentile, meaning it is more likely to be exploited than nearly all other published vulnerabilities. Huntress has published a detailed advisory on active exploitation of SolarWinds Web Help Desk, documenting real-world attacks leveraging this class of vulnerability. The combination of KEV inclusion, near-maximum EPSS percentile, and third-party exploitation reporting makes this one of the most actively targeted vulnerabilities in its disclosure period. Organizations should treat remediation as an emergency priority.
Remediation
- Upgrade to Web Help Desk 2026.1 or later — SolarWinds has released version 2026.1 to address this vulnerability. Review the release notes and apply the update immediately to all affected instances.
- Restrict network access — If immediate patching is not possible, limit network access to the Web Help Desk application by placing it behind a VPN or firewall rules that restrict access to trusted IP ranges only. Do not expose the application directly to the internet.
- Review access logs and audit trails — Given confirmed active exploitation, conduct a thorough review of authentication logs, administrative actions, and ticket modifications to identify any signs of unauthorized access or data tampering.
- Reset credentials — Change all administrative and service account passwords associated with Web Help Desk, as compromised credentials may have been extracted during an exploitation attempt.
- Monitor for indicators of compromise — Consult the Huntress advisory and the SolarWinds security advisory for specific IOCs and detection guidance, and integrate these into your SIEM and endpoint monitoring tools.
- Implement defense-in-depth controls — Deploy web application firewall rules, enable multi-factor authentication for all administrative accounts, and segment the Web Help Desk server from other critical infrastructure to limit lateral movement in case of compromise.
Technical Details
CVE-2025-40536 targets the security control enforcement layer within SolarWinds Web Help Desk versions prior to 2026.1. The vulnerability is categorized as a protection mechanism failure (CWE-693), meaning the application's authentication or authorization checks can be circumvented under specific conditions. The CVSS v3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that while the attack is conducted over the network without any privileges or user interaction, the complexity is high — suggesting that successful exploitation depends on particular environmental conditions, timing, or additional knowledge about the target deployment. The scope is unchanged, meaning the vulnerability's impact is confined to the Web Help Desk application itself rather than extending to the underlying operating system or adjacent services. The affected product configuration encompasses all SolarWinds Web Help Desk installations running versions below 2026.1. Given that Web Help Desk is commonly deployed as a centralized IT service management tool, a successful bypass could provide an attacker with access to sensitive organizational data, user accounts, and configuration controls that could serve as a pivot point for broader network compromise.
Frequently Asked Questions
Who is affected by CVE-2025-40536?
Any organization running SolarWinds Web Help Desk versions prior to 2026.1 is affected. This includes both on-premises and hosted deployments of the application.
Is this vulnerability being actively exploited?
Yes. CISA has added CVE-2025-40536 to its Known Exploited Vulnerabilities catalog, and Huntress has published a report documenting active exploitation of SolarWinds Web Help Desk in real-world attacks.
What can an attacker do with this vulnerability?
An unauthenticated attacker can bypass security controls to access restricted functionality within Web Help Desk. This could include viewing sensitive ticket data, modifying configurations, creating administrative accounts, or disrupting service availability.
Does exploitation require user interaction?
No. The vulnerability can be exploited without any user interaction (UI:N), making it particularly dangerous because it does not require phishing or social engineering.
What is the EPSS score and what does it mean?
The EPSS score is 0.66632, placing it in the 98.50th percentile. This means the vulnerability has a higher predicted probability of exploitation than approximately 98.5% of all known vulnerabilities.
Is there a patch available?
Yes. SolarWinds has released Web Help Desk version 2026.1 which addresses this vulnerability. The update should be applied immediately given confirmed active exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.