CVE-2025-40554 | SolarWinds Web Help Desk was found to be susceptible to an a… | CVSS 9.8 CRITICAL

Description

SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.

Metadata

CVE ID: CVE-2025-40554
State: PUBLISHED
Assigner: SolarWinds
Reserved: 2025-04-16 08:01 UTC
Published: 2026-01-28 07:36 UTC
Last updated: 2026-02-26 15:04 UTC
Primary CWE: CWE-1390
CWE-1390 Weak Authentication
Vendor / Product: SolarWinds / Web Help Desk
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
SolarWinds	Web Help Desk	—	12.8.8 HF1 and below

Weakness (CWE)

CWE	Source	Description
CWE-1390	cna	CWE-1390 Weak Authentication

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (2)