Web Help Desk
CVE-2025-40536
HIGH
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality.
AnalysisAI
SolarWinds Web Help Desk contains a security control bypass vulnerability (CVE-2025-40536) that allows unauthenticated attackers to access restricted functionality. With EPSS 69% and KEV listing, this CVSS 8.1 vulnerability is particularly concerning given SolarWinds' history of being targeted in supply chain attacks and the sensitive IT service data typically stored in help desk systems.
Technical ContextAI
Web Help Desk's security controls can be circumvented by unauthenticated attackers to access functionality that should require administrative privileges. The specific bypass mechanism involves manipulation of request parameters or paths that the application's authorization framework fails to properly validate. Given that help desk systems contain IT asset inventories, ticket histories with sensitive information, and often stored credentials, this represents significant data exposure.
RemediationAI
Apply SolarWinds security update immediately. Restrict Web Help Desk access to internal networks only. Review access logs for unauthorized access patterns. Audit help desk tickets for exposed credentials and rotate any found. Consider the sensitivity of data in WHD when planning remediation priority.
Share
External POC / Exploit Code
Leaving vuln.today