Type Vulnerability
SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality.
SolarWinds
SolarWinds Web Help Desk Security Control Bypass Vulnerability
CVE-2025-40536
What this means
This is rated high severity (8.1 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Solarwinds Web Help Desk is in your estate, and treat that as the priority.
Full vendor description
SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.
Scoring and exploitation
8.1/ 10
CVSS 3.1 base scoreHigh
Exploitable over the network without any account, under specific conditions, and no one has to click or open anything. High impact on confidentiality, integrity and availability.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityHighAC:H
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeUnchangedS:U
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
- Elevated attack likelihood (~73.6% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- SolarWinds Web Help Desk
Weaknesses
CWE-693
Affected products ()
- Solarwinds Web Help Desk
Show the raw CPE strings (1)
- cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*
References
4 links from the CVE record, grouped by site; the vendor's advisory comes first.
solarwinds.com1 linkVendor advisory
- CVE-2025-40536 (opens in a new tab)Vendor Advisory
documentation.solarwinds.com1 link
- whd_2026-1_release_notes.htm (opens in a new tab)Release Notes
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource
huntress.com1 link
- active-exploitation-solarwinds-web-help-desk-cve-2025-26399 (opens in a new tab)Third Party Advisory