A series of critical vulnerabilities in SolarWinds Web Help Desk (WHD) are currently under active exploitation, presenting significant threats to IT environments. The vulnerabilities include multiple remote code execution and authentication bypass flaws, notably CVE-2025-40551, which has a CVSS score of 9.8 and allows unauthenticated remote code execution through untrusted deserialization. These issues come on the heels of SolarWinds’ release of version 2026.1 on January 28, 2026, which addresses these critical flaws alongside five others.
The urgency of the situation is emphasized by CISA’s mandate that federal agencies patch the vulnerabilities within three days, significantly quicker than the typical 14-day window. The vulnerabilities have historical precedence, with similar issues being actively targeted shortly after disclosure. The persistent exploitation is further evidenced by recent attacks in December 2025, where threat actors leveraged similar flaws to breach systems, steal credentials, and maintain persistence using tools like Zoho ManageEngine. Attack techniques included PowerShell scripts, living-off-the-land strategies, and exploiting the flaws to infiltrate networks and deploy backdoors.
Security researchers from watchTowr, <a href="http://Horizon3.ai" target="_blank" rel="noopener nofollow">Horizon3.ai</a>, and Huntress have underscored the significance of these vulnerabilities, given WHD’s history of being a target for cyber attacks and SolarWinds’ past incidents, including the notorious 2020 supply chain attack. Current analyses reveal attackers using sophisticated post-breach methods, such as Velociraptor C2 and Cloudflared tunnels, to exploit Java deserialization vulnerabilities within the Apache Tomcat platform of WHD.
Organizations that have not yet upgraded are at extreme risk, as all WHD versions before 12.8.7 HF1 are vulnerable to attacks, affecting hundreds of thousands of users globally. Immediate measures include updating systems to WHD 2026.1, removing public admin access, conducting thorough scans for unauthorized remote management tools, and promptly rotating credentials to prevent ongoing exploitation and further breaches.

Collections

Critical vulnerabilities in SolarWinds Web Help Desk are being actively exploited, including CVE-2025-40551 (CVSS 9.8) enabling unauthenticated remote code execution through Java deserialization. CISA mandates federal agencies patch within three days instead of the usual 14. Recent attacks have used PowerShell scripts, living-off-the-land techniques, and tools like Velociraptor C2 to breach systems and deploy backdoors. All WHD versions before 12.8.7 HF1 are vulnerable, affecting hundreds of thousands of users. Organizations must immediately upgrade to WHD 2026.1, remove public admin access, scan for unauthorized remote management tools, and rotate credentials.

Critical Vulnerabilities in SolarWinds Web Help Desk Prompt Urgent Patch