CVE-2025-40551
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
Description
CVE-2025-40551 is a critical untrusted data deserialization vulnerability in SolarWinds Web Help Desk that enables unauthenticated remote code execution. With a CVSS v3.1 base score of 9.8, the flaw allows an attacker to send specially crafted serialized data to the application, which is deserialized without validation, leading to arbitrary command execution on the host machine. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 6, 2026, and the ransomware association is currently classified as unknown. The EPSS score of 78.63% at the 99.0th percentile is among the highest exploitation probabilities recorded for any vulnerability, indicating near-certain exploitation of exposed SolarWinds Web Help Desk instances. Versions prior to 2026.1 are affected.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| solarwinds | web help desk | < 2026.1 |
References
- https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm(Release Notes)
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40551(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40551(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2025-40551 is classified under CWE-502 (Deserialization of Untrusted Data). This weakness occurs when an application deserializes data from untrusted sources without sufficient validation, allowing an attacker to manipulate serialized objects to execute arbitrary code, modify application logic, or cause denial of service. In SolarWinds Web Help Desk, the application accepts serialized data through a network-accessible interface and processes it through a deserialization routine that instantiates objects based on the serialized content. An attacker can craft a malicious serialized payload containing instructions to execute operating system commands, which the Java or .NET deserialization process executes during object reconstruction. Deserialization vulnerabilities are particularly dangerous because they bypass normal application logic entirely, turning the serialization framework itself into a code execution mechanism. The pre-authentication nature of this flaw in Web Help Desk means that any network-reachable instance is vulnerable without any credential requirements. Learn more about CWE-502
Impact Analysis
The impact of CVE-2025-40551 is catastrophic across all three dimensions of the CIA triad, amplified by the 78.63% EPSS score that represents near-certain exploitation. Confidentiality is completely compromised because Web Help Desk is an IT service management platform that stores help desk tickets, asset inventory data, IT infrastructure details, user account information, and potentially credentials for integrated systems. An attacker who achieves remote code execution can extract all stored data, including sensitive information submitted through support tickets such as passwords, network diagrams, configuration details, and personal information.
Integrity suffers maximum impact as the attacker can modify help desk records, alter asset management data, inject malicious scripts into the web application, create backdoor accounts, and use the compromised server to pivot into the broader IT infrastructure. Web Help Desk's integration with Active Directory, LDAP, and other IT management systems means the compromised server may have credentials and network access to critical directory services and management platforms.
Availability faces critical risk because the remote code execution capability allows deployment of ransomware, destruction of data, and disruption of IT service management operations. The EPSS score of 78.63% at the 99th percentile places this vulnerability at the absolute top of the exploitation probability distribution, meaning that virtually every exposed instance is being actively targeted. SolarWinds Web Help Desk has historically been a high-value target for sophisticated threat actors due to its position within IT management infrastructure and its access to sensitive organizational data. The ransomware association is unknown, but the deserialization RCE provides the unrestricted access needed for ransomware deployment.
Exploit Maturity
CVE-2025-40551 has among the highest exploit maturity levels observed for any tracked vulnerability. The EPSS score of 78.63% at the 99.0th percentile means that approximately four out of five exposed instances face active exploitation attempts, placing this at the extreme upper end of the exploitation probability spectrum. CISA's KEV listing with a remediation deadline of February 6, 2026 confirms sustained real-world exploitation. The SolarWinds Trust Center advisory provides the vendor's documentation of the vulnerability, and the release notes for Web Help Desk 2026.1 document the fix.
Java deserialization vulnerabilities have a well-established exploitation ecosystem with mature tooling such as ysoserial and similar payload generation frameworks that can produce ready-to-use exploitation payloads for various Java classpath configurations. The pre-authentication nature of this vulnerability eliminates any credential barrier, and the serialization endpoint is typically accessible to any network-reachable client. SolarWinds products have been high-priority targets since the 2020 supply chain attack, and IT management tools like Web Help Desk occupy a privileged position in organizational networks with broad access to infrastructure components. The combination of trivial exploitation, zero authentication requirement, and high-value target positioning explains the extraordinary 78.63% EPSS score.
Remediation
-
Upgrade SolarWinds Web Help Desk to version 2026.1 or later immediately. This is the single most critical remediation action. The deserialization vulnerability is pre-authentication and has a 78.63% EPSS score, meaning exposed instances face near-certain exploitation. Consult the Web Help Desk 2026.1 release notes for upgrade procedures and prerequisites.
-
Block network access to the Web Help Desk server from untrusted networks as an emergency compensating control if immediate patching is not possible. The application should only be accessible from trusted internal networks or through a VPN. Implement firewall rules to block all inbound connections to the Web Help Desk ports from the internet and untrusted network segments. This is the most effective interim mitigation.
-
Conduct an immediate forensic investigation of any Web Help Desk server running a version prior to 2026.1 that was accessible from untrusted networks. Given the 78.63% EPSS score, the probability of prior compromise is extremely high for exposed instances. Review application logs for deserialization-related errors or unusual requests, check for unauthorized processes, examine outbound network connections, and scan for backdoors and web shells.
-
Rotate all credentials and secrets accessible from or stored within the Web Help Desk environment. This includes the Web Help Desk administrator password, database credentials, Active Directory or LDAP service account credentials, API keys for integrated systems, and email account credentials used for ticket processing. Assume all stored credentials have been compromised if the server was exposed.
-
Review integrated system security for any systems that Web Help Desk connects to, including Active Directory, LDAP directories, email servers, and asset management databases. Verify that service accounts have not been used for unauthorized access, check for newly created accounts or permission changes, and audit login activity for anomalies that might indicate the attacker used harvested credentials from the compromised Web Help Desk server.
Technical Details
CVE-2025-40551 is an untrusted data deserialization vulnerability in SolarWinds Web Help Desk, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every vector component reflects maximum exploitability: Attack Vector (AV:N) confirms remote network exploitation. Attack Complexity (AC:L) means exploitation is reliable without special conditions. Privileges Required (PR:N) indicates no authentication is needed. User Interaction (UI:N) confirms fully automated exploitation. Scope (S:U) keeps impact within the Web Help Desk process context, which typically runs with significant system privileges.
The vulnerability exists in how SolarWinds Web Help Desk handles serialized data received through network-accessible interfaces. Java deserialization vulnerabilities exploit the language's native serialization mechanism, which reconstructs objects from a byte stream by invoking constructors, setter methods, and specialized readObject/readResolve methods. When the application deserializes attacker-controlled data, the attacker can include serialized objects from classes available on the application's classpath that have side effects during deserialization. These "gadget chains" link together method calls across multiple classes to achieve arbitrary code execution. Common gadget chains available in Java web applications leverage classes from Apache Commons Collections, Spring Framework, or other widely-used libraries that are typically present in enterprise applications like Web Help Desk.
The attacker constructs a serialized payload containing the appropriate gadget chain for the Web Help Desk classpath, sends it to the vulnerable endpoint without authentication, and the application's deserialization process automatically executes the embedded commands on the underlying operating system. All Web Help Desk versions prior to 2026.1 are affected. The fix in version 2026.1 addresses the vulnerability by implementing deserialization filters that restrict the classes allowed during deserialization, preventing the instantiation of dangerous gadget chain classes.
Frequently Asked Questions
What is CVE-2025-40551?
CVE-2025-40551 is a critical deserialization vulnerability in SolarWinds Web Help Desk that allows unauthenticated remote code execution. With a CVSS score of 9.8 and an EPSS score of 78.63% at the 99th percentile, it is among the most actively exploited vulnerabilities currently tracked.
Why is the EPSS score so high for this vulnerability?
The combination of pre-authentication access, trivial exploitation using well-known Java deserialization tooling, and the high value of IT management infrastructure makes this an extremely attractive target. SolarWinds products are specifically targeted by sophisticated threat actors, and the deserialization attack surface is well-understood with mature exploitation frameworks.
Which versions of Web Help Desk are affected?
All SolarWinds Web Help Desk versions prior to 2026.1 are affected. Organizations must upgrade to version 2026.1 or later to resolve the vulnerability.
Can a web application firewall protect against this vulnerability?
While WAF rules can be configured to detect and block some serialization payloads, they should not be relied upon as the sole protection. Deserialization payloads can be obfuscated in numerous ways to evade signature-based detection. Patching to version 2026.1 is the only reliable remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.