SolarWinds Web Help Desk Vulnerability Exploited (CVE-2025-40551)

THE THREAT

On February 3rd, 2026, CISA added a recently disclosed critical vulnerability in SolarWinds Web Help Desk (WHD) to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, tracked as CVE-2025-40551 (CVSS: 9.8), is an untrusted data deserialization vulnerability in WHD that can allow an unauthenticated attacker to execute commands on the host. Successful exploitation of CVE-2025-40551 may enable an attacker to achieve Remote Code Execution (RCE) on vulnerable systems. SolarWinds disclosed the vulnerability on January 28th, 2026, along with releasing a secure version (2026.1).

A detailed Proof-of-Concept (PoC) exploit was made publicly available shortly after the vulnerability was disclosed. Given the confirmed active exploitation and the availability of exploit code, it is critical for organizations to upgrade SolarWinds WHD to the secure version immediately.

What we're doing about it

• eSentire Managed Vulnerability Service (MVS) has a plugin in place to identify devices vulnerable to the flaw
• eSentire MDR for Network has detections to identify exploitation of CVE-2025-40551
• eSentire's Threat Intelligence team is actively tracking this topic for additional details and detection opportunities

What you should do about it

• After performing a business impact review, upgrade WHD instances to its latest secure version (2026.1)
• In case of suspected exploitation, organizations can review the following WHD log files:
  • WHD session logs to identify any access involving the default client account and access to restricted functionality
  • Audit the logs for JSONRPC errors or whitelisted payloads

Additional information

CVE-2025-40551 was disclosed along with six other vulnerabilities in WHD. Horizon3.ai demonstrated that two of those, CVE-2025-40536 (CVSS: 8.1) and CVE-2025-40537 (CVSS: 7.5) can be chained together with CVE-2025-40551 to gain RCE. An attacker can leverage:

• CVE-2025-40537 to establish an authenticated session, get administrator access, and create a LoginPref component
• CVE-2025-40536 to enable uploading files to the created component
• CVE-2025-40551 to upload and activate malicious Java objects to execute commands on the compromised host

Although the PoC exploit code demonstrates a chained attack, CISA has included only CVE-2025-40551 in its Known Exploited Vulnerabilities (KEV) catalog. It remains unclear whether the other two flaws are also being actively exploited. It is also possible that threat actors leveraged a different exploit to target the deserialization flaw. U.S. Federal agencies are required to remediate the vulnerability by February 6th, 2026.

As SolarWinds Web Help Desk is widely deployed across multiple industry sectors, it is critical for organizations to upgrade their WHD instances to the secure version 2026.1 to reduce the risk of potential exploitation. Additionally, organizations can assess potential compromise by reviewing SolarWinds WHD log files. Session logs may help determine whether the application was accessed using a default client account and whether restricted functionality was invoked. Indicators of malicious Java object uploads may be identified by examining WHD logs for JSON-RPC errors or anomalous whitelisted payloads.

References:
[1] https://www.cisa.gov/news-events/alerts/2026/02/03/cisa-adds-four-known-exploited-vulnerabilities-catalog 
[2] https://nvd.nist.gov/vuln/detail/cve-2025-40551
[3] https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
[4] https://horizon3.ai/attack-research/cve-2025-40551-another-solarwinds-web-help-desk-deserialization-issue/
[5] https://nvd.nist.gov/vuln/detail/CVE-2025-40536
[6] https://nvd.nist.gov/vuln/detail/CVE-2025-40537