CVE-2025-40551
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 83.62%
- CISA KEV
- Known exploited vulnerability
- CWE
- CWE-502
- Published
- 2026-01-28
- Last modified
- 2026-02-26
Affected products
- SolarWinds Web Help Desk
Weakness type
Related vulnerabilities
- CVE-2026-87930 — MaxSite CMS through 109.6 PHP Object Injection via ci_session
- CVE-2026-87874 — Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller
- CVE-2024-58381 — PocketMine-MP before 5.11.1 Denial of Service via LoginPacket
- CVE-2026-11363 — Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import
- CVE-2026-87083 — tile-ai tilelang Kernel Cache kernel_cache.py KernelCache._load_kernel_from_disk deserialization
- CVE-2026-81385 — Microsoft Office Publisher Remote Code Execution Vulnerability
- CVE-2026-77484 — Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-65772 — Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability