Skip to content

2026-02-03 — SolarWinds Web Help Desk deserialization RCE (CVE-2025-40551)

Signal: Added to CISA KEV on 2026-02-03.

Impact (per CISA): SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that can lead to unauthenticated remote code execution.

Vendor/Product: SolarWinds Web Help Desk

Why this matters

Help desk platforms frequently sit at the center of: - user identity (SSO / password resets) - email + ticket workflows (often with privileged mailbox access) - integrations (AD/LDAP, monitoring, asset inventory)

If this service is reachable from the internet (or from broad internal networks), treat as an emergency.

Triage (15–30 minutes)

  1. Find instances

  2. Inventory SolarWinds Web Help Desk deployments (including test/legacy instances).

  3. Confirm exposure

  4. Is Web Help Desk reachable from the internet?

  5. Is it reachable from untrusted internal segments (guest Wi‑Fi, BYOD networks)?

  6. Preserve evidence (fast)

  7. Web/app logs, reverse proxy/WAF logs, and endpoint telemetry.
  8. Capture a process list and network connections on the host if you suspect active exploitation.

Mitigation (do now)

  1. Patch / apply vendor mitigations
  2. Apply SolarWinds guidance for CVE-2025-40551 immediately.

  3. If you can’t patch quickly: take the service offline (or restrict to a tightly controlled VPN/allowlist) until fixed.

  4. Reduce blast radius

  5. Run the service with least privilege.

  6. Restrict outbound network egress from the host (help desk apps rarely need broad outbound access).

  7. Credential hygiene

  8. Rotate any credentials stored/used by the application (SMTP, database, LDAP bind, API keys).

Hunt / detection ideas

  • Unusual inbound requests near deserialization endpoints / atypical payload sizes
  • New processes spawned by the Web Help Desk service account
  • Webshell-like files dropped into app directories
  • Unexpected outbound connections from the WHD host

References