CVE-2025-40551
CRITICAL KEV NUCLEISolarWinds Web Help Desk < 2026.1 - Unauthenticated Remote Code Execution via Untrusted Data Deserialization
Title source: llmExploitation Summary
CVE-2025-40551 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 3, 2026.
EIP tracks 1 public exploit from researchers including Jimi Sebree, sfewer-r7, including a Metasploit module exploits/multi/http/solarwinds_webhelpdesk_rce.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits CVE-2025-40536 (access control bypass) and CVE-2025-40551 (unsafe deserialization) to achieve unauthenticated RCE on SolarWinds Web Help Desk (WHD) versions 12.7.* and 12.8.* on Windows and Linux. It uses JNDI injection and SMB server setup for payload delivery.
Description
SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.
Exploits (1)
This Metasploit module exploits CVE-2025-40536 (access control bypass) and CVE-2025-40551 (unsafe deserialization) to achieve unauthenticated RCE on SolarWinds Web Help Desk (WHD) versions 12.7.* and 12.8.* on Windows and Linux. It uses JNDI injection and SMB server setup for payload delivery.
Nuclei Templates (1)
http.favicon.hash:1895809524
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H