CVE-2025-40552 Details
Description
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.
An authentication bypass vulnerability has been identified in SolarWinds Web Help Desk. This vulnerability allows malicious actors to perform actions and access methods that should require authentication. The issue arises from a flaw in the application's authentication mechanism, which can be exploited to bypass security controls and gain unauthorized access to certain functionalities.
Users can upgrade to SolarWinds Web Help Desk version 2026.1, which addresses this vulnerability. Instructions for downloading the update are available on the SolarWinds website and through the Customer Portal.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jan 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1390 | Weak Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| solarwinds web help desk | < 2026.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 26, 2026 | CVE Modified | CISA-ADP |
| Feb 3, 2026 | Initial Analysis | [email protected] |
| Jan 28, 2026 | New CVE Received | [email protected] |