- SolarWinds released security updates for its Web Help Desk software to address six severe vulnerabilities, four of which are critical with CVSS scores of 9.8.
- The critical flaws allow unauthenticated attackers to bypass authentication and achieve remote code execution (RCE) on affected systems, giving them control over the host machine.
- Researchers from Horizon3.ai and watchTowr discovered the vulnerabilities, with some similar past SolarWinds flaws already cataloged as actively exploited.
SolarWinds patched multiple critical security flaws in its Web Help Desk software on January 29, 2026, after researchers found severe vulnerabilities enabling total system takeover. Among the six issues are four critical vulnerabilities rated 9.8 on the CVSS scale, which allow unauthenticated remote code execution.
Two of the critical flaws, CVE-2025-40551 and CVE-2025-40553, are untrusted data deserialization issues that let attackers run arbitrary commands. Consequently, an RCE via deserialization is a highly reliable vector for attackers to leverage. The other two critical flaws, CVE-2025-40552 and CVE-2025-40554, are authentication bypasses that can also lead to RCE.
Researchers Jimi Sebree from Horizon3.ai and Piotr Bazydlo from watchTowr discovered the vulnerabilities, which are all fixed in WHD 2026.1. Meanwhile, a detailed post by Sebree described CVE-2025-40551 as a deserialization issue from the AjaxProxy functionality.
The company has a history of patching similar flaws in Web Help Desk, including CVE-2024-28986 and CVE-2024-28987. Previously, the U.S. Cybersecurity and Infrastructure Security Agency added those older flaws to its Known Exploited Vulnerabilities catalog due to active exploitation. Therefore, customers must urgently update to the latest version to mitigate this significant risk.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
