CVE-2025-40554

SolarWinds Web Help Desk Authentication Bypass Vulnerability

State: Published
Severity: 9.8 Critical
Published: Jan 28, 2026
Updated: Feb 26, 2026
Reserved: Apr 16, 2025

Description

SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	SolarWinds

Weaknesses

CWE-1390 Weak Authentication

Affected Products

Product	Versions
Web Help DeskSolarWinds	12.8.8 HF1 and belowAffected

References

https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40554vendor-advisorypatch
https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htmrelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.