Skip to main content

CVE detail

CVE-2025-40553

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

CVSS 9.8 · CriticalBuzz score 40.3

Buzz score

Why this CVE is surfacing

Buzz score total 40.3

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 20.8 · diversity 19.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
20.8
7 evidence mentions in the snapshot
Diversity score
19.5
6 sources across 3 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
7 source links · newest first
  • 16th March – Threat Intelligence ReportCheck Point Research

    For the latest discoveries in cyber research for the week of 16th March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES United States-based medical technology company Stryker has suffered a cyberattack that caused a global disruption to its environment. The company said its surgical robotics, clinical communications platform, and life support monitors are […]

    vendorresearch.checkpoint.comMar 16, 2026, 3:09 PM
  • 2nd March – Threat Intelligence ReportCheck Point Research

    For the latest discoveries in cyber research for the week of 2nd March, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Wynn Resorts, a United States-based casino and hotel operator, has confirmed that employee data was accessed following an extortion threat linked to ShinyHunters. The company said operations were not disrupted. Reports indicate […]

    vendorresearch.checkpoint.comMar 2, 2026, 4:29 PM
  • h RCE on what was, at the time, a fully patched instance. Well-intentioned as always, our initial goal was to reproduce CVE-2025-26399 - a previously patched SolarWinds Web Help Desk deserialization RCE disclosed in 2025. The vulnerabilities we discovered are: CVE-2025-40552 / WT-2025-0099 - Authentication Bypass CVE-2025-40553 / WT-2025-0100 - Remote

    exploitlabs.watchtowr.comFeb 25, 2026, 8:06 PM
  • SolarWinds patched six Web Help Desk vulnerabilities, including four critical flaws exploitable without authentication for RCE or auth bypass. SolarWinds released security updates to address six Web Help Desk vulnerabilities, including four critical bugs that allow unauthenticated remote code execution or authentication bypass. The three critical flaws found by watchTowr, and specifically by researcher Piotr […]

    newssecurityaffairs.comJan 29, 2026, 7:17 PM
  • The four critical flaws could be exploited without authentication for remote code execution or authentication bypass.

    newswww.securityweek.comJan 29, 2026, 1:18 PM
  • SolarWinds has fixed six critical and high-severity vulnerabilities in its popular Web Help Desk (WHD) support ticketing and asset management solution, and is urging customers to upgrade to v2026.1 as soon as possible. The vulnerabilities The WHD vulnerabilities fixed were unearthed by Jimi Sebree from Horizon3.ai and Piotr Bazydlo from watchTowr. Sebree flagged a security control bypass flaw (CVE-2025-40536), hardcoded/static credentials (CVE-2025-40537), and an untrusted data deserialization vulnerability (CVE-2025-40551). While the first two may allow … More →

    newswww.helpnetsecurity.comJan 29, 2026, 9:17 AM
  • SolarWinds is yet again disclosing security vulnerabilities in one of its widely-used products. The company has released updates to patch six critical authentication bypass and remote command execution vulnerabilities in its Web Help Desk (WHD) IT software. These flaws could allow attackers to bypass authentication, perform remote code execution (RCE), and access certain functionality that should […]

    newswww.csoonline.comJan 29, 2026, 3:11 AM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2025-40551

    SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to…

    CVSS 9.8 · Critical
    KEV listed14 mentions
  • CVE-2025-26399

    SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacke…

    CVSS 9.8 · Critical
    KEV listed23 mentions
  • CVE-2024-28988

    SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on t…

    CVSS 9.8 · Critical
    12 mentions
  • CVE-2024-28986

    SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on t…

    CVSS 9.8 · Critical
    KEV listed33 mentions
  • CVE-2026-14974

    IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

    CVSS 8.1 · High
    1 mention
  • CVE-2026-14512

    IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication o…

    CVSS 9.8 · Critical
    1 mention