CVE-2025-40551 is an unauthenticated deserialization-of-untrusted-data flaw in SolarWinds Web Help Desk that lets a remote attacker run arbitrary commands on the host without credentials; CISA added it to KEV in February 2026, and the 9.8 CVSS figure on record is SolarWinds' own CNA score rather than an NVD Primary rating.
Vulnerability summary
9.8
Critical
84.2%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-01-28
Published
Vulnerability ID: CVE-2025-40551 · Source: SolarWinds PSIRT (CVSS not NVD-confirmed)
Affected components
| Component | CPE | Version range |
|---|---|---|
| SolarWinds Web Help Desk | cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:* | 12.8.8 HF1 and all prior versions (fixed in 2026.1) |
What this means
CVE-2025-40551 is a Deserialization of Untrusted Data vulnerability (CWE-502) in SolarWinds Web Help Desk, an IT help-desk ticketing product. NVD's description states Web Help Desk "was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine," and specifies "this could be exploited without authentication" (NVD).
NVD's record shows vulnStatus "Analyzed," but the only CVSS metric on file is a CVSS v3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) submitted by SolarWinds' own PSIRT ([email protected]) and marked Secondary — there is no independent NVD Primary CVSS metric for this CVE as of this check. This page therefore attributes the 9.8 score to SolarWinds PSIRT rather than NVD, while still indexing the page because the CVE's presence in the CISA KEV catalog independently satisfies our publishing bar (NVD).
SolarWinds' own trust-center advisory confirms the affected range as "version 12.8.8 HF1 and all previous versions," with the fix shipped in Web Help Desk 2026.1, and credits the discovery to Jimi Sebree working with Horizon3.ai (SolarWinds Trust Center Advisory).
CISA added CVE-2025-40551 to the Known Exploited Vulnerabilities catalog on 2026-02-03, with a required-action due date of 2026-02-06; known ransomware campaign use is recorded as "Unknown" (CISA KEV).
This is the second distinct SolarWinds product CVE on this site after Serv-U's unauthenticated Deflate DoS (CVE-2026-28318), underscoring that SolarWinds' on-premises help-desk and file-transfer products have each drawn independent, KEV-confirmed exploitation in 2026. FIRST EPSS currently scores the probability of exploitation at 0.8418 (99.7th percentile) as of 2026-10-30 (FIRST EPSS).
Any Web Help Desk instance at 12.8.8 HF1 or earlier should be upgraded to 2026.1 immediately; because exploitation requires no authentication, internet-facing instances should also be reviewed for signs of prior compromise.
Evidence
- SolarWinds Web Help Desk is susceptible to deserialization of untrusted data leading to unauthenticated remote code execution, allowing an attacker to run commands on the host. — NVD
- NVD vulnStatus is Analyzed, but the only CVSS metric present (3.1, 9.8) is sourced from [email protected] and marked type Secondary; no NVD Primary CVSS metric exists for this CVE. — NVD
- Affected: Web Help Desk 12.8.8 HF1 and all previous versions; fixed in 2026.1; discovered by Jimi Sebree working with Horizon3.ai. — SolarWinds Trust Center Advisory
- Added to the CISA KEV catalog on 2026-02-03, due date 2026-02-06, known ransomware campaign use Unknown. — CISA KEV
- EPSS score is 0.8418 (99.7th percentile) as of 2026-10-30. — FIRST EPSS
