SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Technical Severity

CVSS v3.1 Metrics

CRITICAL

9.8 / 10

Minimal Risk Critical

Vector Specification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation Likelihood

EPSS Prediction

88.80 %

Predictive Probability

Percentile Rank

99.5 th

Documented as more likely to be exploited than 99.5% of known CVEs.

Detection Date

Feb 03, 2026

Remediation Due

Feb 06, 2026

CISA Catalog Active

Threat Analysis

SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

Remediation Directive

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

External Intelligence

https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40551

NVD

National Vulnerability Database

https://nvd.nist.gov/vuln/detail/CVE-2025-40551