What is the CVSS score of CVE-2025-40552?

CVE-2025-40552 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 9.9%.

Which versions of Web Help Desk are affected by CVE-2025-40552?

SolarWinds Web Help Desk contains a critical authentication bypass vulnerability (CVSS 9.8) that allows attackers to perform unauthorized actions without valid credentials.

How to fix or mitigate CVE-2025-40552?

Within 24 hours: Identify all SolarWinds Web Help Desk instances in your environment and isolate them from untrusted networks; enable comprehensive logging and begin threat hunting for suspicious activity. Within 7 days: Implement network segmentation to restrict access to Web Help Desk to authorized users only, deploy WAF rules to block exploitation attempts, and contact SolarWinds for patch timelines and workarounds. Within 30 days: Evaluate migration to alternative help desk solutions or maintain strict network access controls until an official patch is released; conduct a full security audit of affected systems.

Web Help Desk CVE-2025-40552

CRITICAL

Weak Authentication (CWE-1390)

2026-01-28 psirt@solarwinds.com

Authentication Bypass Web Help Desk

9.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 28, 2026 - 08:16 nvd

CRITICAL 9.8

DescriptionNVD

SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.

AnalysisAI

SolarWinds Web Help Desk has an authentication bypass vulnerability (EPSS 9.9%) that allows unauthenticated attackers to gain admin access to the helpdesk system.

Technical ContextAI

SolarWinds WHD has a CWE-1390 weak authentication vulnerability that allows attackers to bypass authentication and gain administrative access without credentials.

RemediationAI

Patch all four WHD vulnerabilities simultaneously. Assume compromise if running affected versions.

CVE-2025-40552 vulnerability details – vuln.today

Back

Web Help Desk CVE-2025-40552

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Share

External POC / Exploit Code