CVE-2025-40554

The vulnerability results from improper user identity verification in the Web Help Desk application. An attacker, operating remotely without authentication and without any interaction from the victim, can trigger specific actions within the system. The attack vector is network-based (AV:N), attack complexity is low (AC:L), meaning exploitation of this vulnerability does not require specialized knowledge or special conditions.

Successful exploitation of this vulnerability may allow an attacker to perform unauthorized operations in the SolarWinds Web Help Desk system, potentially leading to breaches of confidentiality, integrity, and availability of data managed by the helpdesk system.

Apply patches available from the vendor according to references — update SolarWinds Web Help Desk to the version described in WHD 2026-1 release notes available at: https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm

SolarWinds Web Help Desk — specific vulnerable versions indicated in vendor references (WHD 2026-1 release notes and SolarWinds advisory)