CVE-2025-40551
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
Analysis
SolarWinds Web Help Desk contains an unauthenticated Java deserialization vulnerability (CVE-2025-40551, CVSS 9.8) that enables remote code execution. With EPSS 80.6% and KEV listing, this is the more severe of two concurrent WHD vulnerabilities, allowing attackers to execute arbitrary commands on the host server without any credentials.
Technical Context
The application accepts serialized Java objects from unauthenticated HTTP requests. An attacker can construct a malicious serialized object using common Java deserialization gadget chains (such as those from Apache Commons Collections, Spring Framework, or other libraries bundled with WHD) that execute arbitrary OS commands when deserialized. The attack is straightforward with tools like ysoserial and requires no authentication or prior knowledge of the target beyond its URL.
Affected Products
['SolarWinds Web Help Desk (versions prior to security update)']
Remediation
Apply SolarWinds security update immediately — this is highest priority. Take WHD offline if patching is delayed. Block external access to WHD. Monitor for Java deserialization attack indicators (unusual POST payloads, ysoserial signatures). Conduct incident response investigation to determine if exploitation has already occurred.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today