CVE-2025-40554 in the critical feed json
SolarWinds Web Help Desk Authentication Bypass Vulnerability
published 2026-01-28 9 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-206480
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 60.6%
- EPSS 60.6% chance of exploitation in 30 days, percentile 99.1%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.
Patch / fix
- solarwinds web_help_desk 2026.1
Ransomware
Groups reported to have exploited it in intrusions.
- Qilin ransomware gang
reported by ctrlaltintel.com
Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 9 mo ago
Exploit prediction
60.64% chance of exploitation in the next 30 days, higher than 99.1% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template SolarWinds Web Help Desk - Authentication Bypass nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- SolarWinds Web Help Desk
Classification
- Weakness
-
- CWE-1390 Weak Authentication
References
Sources
- CVE List CVE-2025-40554
- NVD CVE-2025-40554
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.