{"id":"solarwinds-help-desk-bypass-attacks-feb-2026","category":"patch","status":"closed","title":"SolarWinds Web Help Desk security bypass CVE-2025-40536 used in attacks; fix available","tldr":"Attackers are exploiting a security bypass in SolarWinds Web Help Desk 12.8.8 HF1 and earlier. Organisations running it should upgrade to 2026.1 or later and investigate possible compromise. This is an IT support server update.","summary":"CVE-2025-40536 lets someone without a login bypass a security protection and reach restricted functions in SolarWinds Web Help Desk, software organisations use to manage IT support tickets and assets. SolarWinds disclosed it on 28 January and supplied the fix in version 2026.1; version 12.8.8 HF1 and all earlier releases are affected. The vendor rates it High, with a score of 8.1. CISA confirmed exploitation by adding it to its catalogue on 12 February. Microsoft separately described December 2025 Web Help Desk intrusions involving credential theft and access to other systems, but could not identify the exact flaw used. Those intrusions therefore do not establish a December start for this CVE. As at 3 November, the vendor still identifies 2026.1 as the fixed release. Public reporting provides no detailed account of the CVE-specific attacks or confirmation that previously compromised systems have been cleared.","action":"If your business or family office runs SolarWinds Web Help Desk, ask its IT provider to upgrade to 2026.1 or later and check for signs of intrusion. Suspected compromises need investigation and credential resets as well as patching. Families who do not operate this server have no update to install.","product":"SolarWinds Web Help Desk","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2025-40536"],"tags":["solarwinds","web-help-desk","security-bypass","actively-exploited","enterprise"],"affected":["SolarWinds Web Help Desk 12.8.8 HF1 and all previous versions"],"fixed":["SolarWinds Web Help Desk 2026.1"],"matches":[],"sources":[{"kind":"advisory","title":"SolarWinds Web Help Desk Security Control Bypass Vulnerability (CVE-2025-40536)","url":"https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40536","by":"SolarWinds","date":"2026-01-28"},{"kind":"advisory","title":"WHD 2026.1 release notes","url":"https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm","by":"SolarWinds","date":"2026-01-28"},{"kind":"research","title":"Analysis of active exploitation of SolarWinds Web Help Desk","url":"https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/","by":"Microsoft","date":"2026-02-06"},{"kind":"advisory","title":"SolarWinds security advisory (AV26-063) - Update 2","url":"https://www.cyber.gc.ca/en/alerts-advisories/solarwinds-security-advisory-av26-063-update-1","by":"Canadian Centre for Cyber Security","date":"2026-02-13"},{"kind":"news","title":"CISA orders federal agencies to patch exploited SolarWinds, Apple, Microsoft bugs within weeks","url":"https://therecord.media/cisa-orders-federal-agencies-to-patch-solarwinds-microsoft-apple-bugs","by":"The Record","date":"2026-02-13"},{"kind":"news","title":"CISA Warns of Exploited SolarWinds, Notepad++, Microsoft Vulnerabilities","url":"https://www.securityweek.com/cisa-warns-of-exploited-solarwinds-notepad-microsoft-vulnerabilities/","by":"SecurityWeek","date":"2026-02-13"}],"started":"2026-02-12","closed":"2026-02-13","created":"2026-11-03T22:31:17.111Z","updated":"2026-11-03T22:31:17.111Z","cve_notes":[{"cve":"CVE-2025-40536","name":"Security control bypass in SolarWinds Web Help Desk","what":"A failed security protection in SolarWinds Web Help Desk lets an attacker without a login reach functions that should be restricted.","severity":"high","cvss":8.1}],"timeline":[{"at":"2026-02-13","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"The Record reported that US federal civilian agencies had until 15 February to patch this flaw, following CISA's unusually short remediation deadline.","url":"https://therecord.media/cisa-orders-federal-agencies-to-patch-solarwinds-microsoft-apple-bugs","by":"The Record","patch":null},{"at":"2026-02-12","added":"2026-11-03T22:24:44.025Z","kind":"cisa-added","text":"CISA added CVE-2025-40536 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. The Canadian Centre for Cyber Security recorded the addition in its updated advisory.","url":"https://www.cyber.gc.ca/en/alerts-advisories/solarwinds-security-advisory-av26-063-update-1","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-02-06","added":"2026-11-03T22:24:44.025Z","kind":"other","text":"Microsoft reported December 2025 intrusions through exposed Web Help Desk servers, followed by credential theft and movement into other systems. It could not confirm which vulnerability provided access, so these attacks cannot be attributed specifically to CVE-2025-40536.","url":"https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/","by":"Microsoft","patch":null},{"at":"2026-01-28","added":"2026-11-03T22:24:44.025Z","kind":"new-fix","text":"SolarWinds released Web Help Desk 2026.1, fixing CVE-2025-40536. Its advisory identifies 12.8.8 HF1 and all earlier versions as affected.","url":"https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40536","by":"SolarWinds","patch":"patched"}],"url":"https://hard.fyi/live/solarwinds-help-desk-bypass-attacks-feb-2026/","json":"https://hard.fyi/api/live?id=solarwinds-help-desk-bypass-attacks-feb-2026"}