CVE detail
CVE-2025-40553
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 20.8 · diversity 19.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
7 source links · newest first
- 16th March – Threat Intelligence ReportCheck Point Research
For the latest discoveries in cyber research for the week of 16th March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES United States-based medical technology company Stryker has suffered a cyberattack that caused a global disruption to its environment. The company said its surgical robotics, clinical communications platform, and life support monitors are […]
vendorresearch.checkpoint.comMar 16, 2026, 3:09 PM - 2nd March – Threat Intelligence ReportCheck Point Research
For the latest discoveries in cyber research for the week of 2nd March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Wynn Resorts, a United States-based casino and hotel operator, has confirmed that employee data was accessed following an extortion threat linked to ShinyHunters. The company said operations were not disrupted. Reports indicate […]
vendorresearch.checkpoint.comMar 2, 2026, 4:29 PM - Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s))watchTowr Labs
h RCE on what was, at the time, a fully patched instance. Well-intentioned as always, our initial goal was to reproduce CVE-2025-26399 - a previously patched SolarWinds Web Help Desk deserialization RCE disclosed in 2025. The vulnerabilities we discovered are: CVE-2025-40552 / WT-2025-0099 - Authentication Bypass CVE-2025-40553 / WT-2025-0100 - Remote
exploitlabs.watchtowr.comFeb 25, 2026, 8:06 PM - SolarWinds addressed four critical Web Help Desk flawsSecurity Affairs
SolarWinds patched six Web Help Desk vulnerabilities, including four critical flaws exploitable without authentication for RCE or auth bypass. SolarWinds released security updates to address six Web Help Desk vulnerabilities, including four critical bugs that allow unauthenticated remote code execution or authentication bypass. The three critical flaws found by watchTowr, and specifically by researcher Piotr […]
newssecurityaffairs.comJan 29, 2026, 7:17 PM The four critical flaws could be exploited without authentication for remote code execution or authentication bypass.
newswww.securityweek.comJan 29, 2026, 1:18 PMSolarWinds has fixed six critical and high-severity vulnerabilities in its popular Web Help Desk (WHD) support ticketing and asset management solution, and is urging customers to upgrade to v2026.1 as soon as possible. The vulnerabilities The WHD vulnerabilities fixed were unearthed by Jimi Sebree from Horizon3.ai and Piotr Bazydlo from watchTowr. Sebree flagged a security control bypass flaw (CVE-2025-40536), hardcoded/static credentials (CVE-2025-40537), and an untrusted data deserialization vulnerability (CVE-2025-40551). While the first two may allow … More →
newswww.helpnetsecurity.comJan 29, 2026, 9:17 AMSolarWinds is yet again disclosing security vulnerabilities in one of its widely-used products. The company has released updates to patch six critical authentication bypass and remote command execution vulnerabilities in its Web Help Desk (WHD) IT software. These flaws could allow attackers to bypass authentication, perform remote code execution (RCE), and access certain functionality that should […]
newswww.csoonline.comJan 29, 2026, 3:11 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2025-40551CVSS 9.8 · Critical
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to…
- CVE-2025-26399CVSS 9.8 · Critical
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacke…
- CVE-2024-28988CVSS 9.8 · Critical
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on t…
- CVE-2024-28986CVSS 9.8 · Critical
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on t…
- CVE-2026-14974CVSS 8.1 · High
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.
- CVE-2026-14512CVSS 9.8 · Critical
IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication o…