SolarWinds Warns of Critical Web Help Desk RCE and Auth Bypass Flaws

SolarWinds has released security updates to address critical vulnerabilities in its Web Help Desk IT help desk software, including authentication bypass flaws and remote code execution (RCE) vulnerabilities that could allow unauthenticated attackers to compromise systems with low-complexity attacks.

Critical Vulnerabilities Patched

The authentication bypass security flaws, tracked as CVE-2025-40552 and CVE-2025-40554, were reported by watchTowr's Piotr Bazydlo. These vulnerabilities can be exploited by remote unauthenticated threat actors in low-complexity attacks, potentially allowing unauthorized access to systems without requiring valid credentials.

Bazydlo also discovered a critical remote code execution flaw (CVE-2025-40553) stemming from an untrusted data deserialization weakness. This vulnerability could enable attackers without privileges to run commands on vulnerable hosts, effectively giving them complete control over affected systems.

A second RCE vulnerability (CVE-2025-40551) was reported by Horizon3.ai security researcher Jimi Sebree. This flaw similarly allows unauthenticated attackers to execute commands remotely, compounding the risk to organizations using the affected software.

Additional Security Issues Addressed

In addition to the critical vulnerabilities, SolarWinds also patched a high-severity hardcoded credentials vulnerability (CVE-2025-40537), also discovered by Sebree. Under unspecified circumstances, this flaw could grant threat actors with low privileges unauthorized access to administrative functions, potentially escalating their access level within compromised systems.

Urgent Upgrade Recommendations

SolarWinds provides detailed instructions for upgrading vulnerable servers to Web Help Desk 2026.1, which addresses these security flaws. Administrators are strongly advised to patch their devices as soon as possible, given the critical nature of these vulnerabilities and the history of exploitation in the wild.

Historical Context of Exploitation

The urgency of these patches is underscored by the history of Web Help Desk vulnerabilities being actively exploited in attacks. In September, SolarWinds addressed a second patch bypass (CVE-2025-26399) for a WHD RCE flaw that CISA flagged as actively exploited in attacks more than a year earlier. This vulnerability was added to CISA's catalog of exploited security bugs, with federal agencies ordered to secure their systems within three weeks.

At the time, SolarWinds explained that the vulnerability was "a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986." This chain of vulnerabilities demonstrates the persistent nature of security issues in the software and the ongoing efforts by attackers to find ways around patches.

CISA also tagged a critical Web Help Desk hardcoded credentials flaw as actively exploited in October 2024, again requesting government agencies to patch their devices promptly.

Widespread Use and Impact

Web Help Desk (WHD) is widely used by large corporations, healthcare organizations, educational institutions, and government agencies for help desk management. SolarWinds states that its IT management products are used by more than 300,000 customers worldwide, making these vulnerabilities particularly significant in terms of potential impact.

Related Security Developments

The discovery and patching of these vulnerabilities come amid other significant security developments in the IT management and help desk software space. Organizations using SolarWinds products should also be aware of recent security issues affecting similar platforms, including:

• Critical Fortinet FortiSIEM flaws that are now being exploited in attacks
• Cisco AsyncOS zero-day vulnerabilities that have been exploited since November
• Max severity Ni8mare flaws that allow hackers to hijack n8n servers

The pattern of vulnerabilities being discovered and exploited in IT management tools highlights the importance of maintaining robust security practices and promptly applying security updates across all enterprise software systems.

Conclusion

The discovery of multiple critical vulnerabilities in SolarWinds Web Help Desk underscores the ongoing security challenges faced by organizations using complex IT management software. With authentication bypass flaws, remote code execution vulnerabilities, and hardcoded credentials all present in the same product, the potential for serious security breaches is significant.

Organizations using Web Help Desk should prioritize upgrading to version 2026.1 immediately and review their security configurations to ensure they are not vulnerable to these newly disclosed flaws. The history of these vulnerabilities being exploited in the wild makes prompt action essential to protect sensitive systems and data from potential compromise.