What is the CVSS score of CVE-2025-40552?

CVE-2025-40552 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 9.9%.

Which versions of Web Help Desk are affected by CVE-2025-40552?

SolarWinds Web Help Desk contains a critical authentication bypass vulnerability (CVSS 9.8) that allows attackers to perform unauthorized actions without valid credentials.

Is there a public PoC exploit available for CVE-2025-40552?

Yes, a public proof-of-concept exploit is available for CVE-2025-40552. Prioritise patching immediately. EPSS: 9.9%.

How to fix or mitigate CVE-2025-40552?

Within 24 hours: Identify all SolarWinds Web Help Desk instances in your environment and isolate them from untrusted networks; enable comprehensive logging and begin threat hunting for suspicious activity. Within 7 days: Implement network segmentation to restrict access to Web Help Desk to authorized users only, deploy WAF rules to block exploitation attempts, and contact SolarWinds for patch timelines and workarounds. Within 30 days: Evaluate migration to alternative help desk solutions or maintain strict network access controls until an official patch is released; conduct a full security audit of affected systems.

Web Help Desk CVE-2025-40552

CRITICAL

Weak Authentication (CWE-1390)

2026-01-28 psirt@solarwinds.com

Authentication Bypass Web Help Desk

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 28, 2026 - 08:16 nvd

CRITICAL 9.8

DescriptionCVE.org

SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.

AnalysisAI

SolarWinds Web Help Desk has an authentication bypass vulnerability (EPSS 9.9%) that allows unauthenticated attackers to gain admin access to the helpdesk system.

Technical ContextAI

SolarWinds WHD has a CWE-1390 weak authentication vulnerability that allows attackers to bypass authentication and gain administrative access without credentials.