Key facts: SolarWinds Web Help Desk vulnerability
- Date reported: February 3, 2026.
- Discovery date: Originally reported to SolarWinds on December 5, 2025.
- Target software: SolarWinds Web Help Desk (WHD).
- Critical vulnerability: CVE-2025-40551 (CVSS score: 9.8/10).
- Cause: Untrusted data deserialization in the AjaxProxy component.
- Status: Actively exploited in the wild; added to CISA's Known Exploited Vulnerabilities (KEV) catalog.
- Remediation: Federal agencies were mandated by CISA to patch by February 6, 2026.
What is the SolarWinds Web Help Desk Vulnerability?
On February 3, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability in SolarWinds Web Help Desk (WHD) to its list of flaws known to be exploited by hackers. This vulnerability, tracked as CVE-2025-40551, is a "deserialization of untrusted data" flaw. It allows a remote, unauthenticated attacker to execute arbitrary commands on the host machine—essentially giving them full control over the server without needing a username or password.
This is the latest in a series of "bypass" bugs where attackers have found ways to circumvent previous security patches for the same component. While SolarWinds released a fixed version (version 2026.1) on January 28, 2026, the subsequent discovery of active exploitation led CISA to issue an urgent three-day patching deadline for federal civilian agencies.
Who is behind the incident?
While the vulnerability is being actively exploited, no specific threat actor or nation-state group has been officially named in connection with the current wave of attacks. However, IT management and help desk platforms are high-priority targets for sophisticated actors because they often hold administrative privileges and provide a "pivot point" to move deeper into an organization's internal network.
Impact and risks for SolarWinds customers
For organizations using SolarWinds Web Help Desk, the primary risk is Remote Code Execution (RCE). If an attacker successfully exploits this flaw, they can:
- Install malware or ransomware directly on the server.
- Exfiltrate sensitive internal support tickets, which often contain employee credentials or network configuration details.
- Modify or delete critical system data.
- Use the compromised server as a jumping-off point to attack other parts of the network.
Because help desk software is frequently exposed to the internet to allow remote users to submit tickets, the attack surface is significant. There is a plausible risk that any data stored within the help desk—including user contact info and internal IT notes—could be compromised if the system remains unpatched.
Frequently asked questions
What is the SolarWinds Help Desk Vulnerability?
The incident involves a critical software flaw (CVE-2025-40551) in the Web Help Desk product. It is not a breach of SolarWinds' own corporate network, but rather a vulnerability in the software they sell, which hackers are now using to attack the organizations that use it.
What data was exposed?
The data at risk depends entirely on what an individual organization stores in its Web Help Desk instance. This typically includes IT support tickets, asset management data, employee contact information, and potentially sensitive internal system details.
Is my personal information at risk?
If you are an employee or a client of an organization that uses an unpatched version of SolarWinds Web Help Desk, your support ticket history and contact details could be at risk. You should check with your IT department to see if they have applied the 2026.1 update.
How can I protect myself from this exposure?
- For Admins: Upgrade to SolarWinds Web Help Desk version 2026.1 immediately.
- For Users: Change passwords for any accounts that may have been referenced in IT support tickets.
- Enable multi-factor authentication (MFA) on all sensitive services to prevent attackers from using stolen credentials.
- Monitor for unusual login attempts or phishing emails that appear to come from your IT help desk.
What steps should companies take after being breached?
If exploitation is suspected, companies should isolate the affected server, perform a full forensic audit to see if the attacker moved elsewhere in the network, and rotate all secrets or credentials that were stored in or accessible by the Web Help Desk service.
.jpg)
.jpg)
.jpg)
