CVE-2025-40552 - SolarWinds Web Help Desk Authentication Bypass Vulnerability

Back Back to CVE browser

CRITICAL

SolarWinds Web Help Desk Authentication Bypass Vulnerability

Published Jan 28, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 52.00%

Description

SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.

Affected products

Vendor SolarWinds Product Web Help Desk Default
affected
- Version
  12.8.8 HF1 and below
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SolarWinds

Web Help Desk

affected

Version	Status	Constraints
12.8.8 HF1 and below	affected	-

Remediation

Vendor solution

SolarWinds recommends customers upgrade to Web Help Desk version 2026.1.

Weaknesses (1)

CWE-1390

References (4)

https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
Release Notes
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-206429
Advisory
https://github.com/watchtowrlabs/watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553/blob/main/watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553.py
exploit
https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40552
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm		Release Notes
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-206429		Advisory
https://github.com/watchtowrlabs/watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553/blob/main/watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553.py		exploit
https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40552		vendor-advisorypatchVendor Advisory