CVE-2025-40536

HIGH8.1

CISA KEVPublic PoCHigh EPSS

Description

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.

CVSS breakdown

CVSS 3.1

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected products

SolarWinds / Web Help Desk12.8.8 HF1 and below – 12.8.8 HF1 and below

Exploits & proofs of concept

nucleiSolarWinds Web Help Desk < 12.8.8 Hotfix 1 (HF1) - Security Control Bypassby inokii

References

VENDOR_ADVISORYhttps://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40536
MISChttps://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm