{"id":"solarwinds-web-help-desk-attacks-jan-2026","category":"patch","status":"closed","title":"SolarWinds Web Help Desk flaw CVE-2025-40551 used in attacks; fix available","tldr":"Attackers are exploiting a flaw that lets them run commands on SolarWinds Web Help Desk servers without logging in. Organisations running version 12.8.8 HF1 or earlier should upgrade to 2026.1 or later and check for compromise.","summary":"CVE-2025-40551 affects SolarWinds Web Help Desk, software organisations use to manage IT support tickets and equipment. Its handling of untrusted data can let a remote attacker run commands on the server without logging in. SolarWinds disclosed the flaw and released the fix in version 2026.1 on 28 January. CISA confirmed exploitation by adding it to its catalogue on 3 February, and SolarWinds subsequently published signs of compromise. Microsoft separately described Web Help Desk intrusions involving remote access and credential theft, but could not determine which vulnerability attackers used in those cases. Elastic reiterated that uncertainty on 10 February. As at 3 November, SolarWinds lists 12.8.8 HF1 and all earlier versions as affected and 2026.1 as fixed. The reviewed sources do not establish that attacks have ended. Updating closes this flaw; potentially compromised organisations also need investigation and recovery.","action":"Nothing to install on a family’s personal devices: this affects an organisation’s help-desk server. If your business or family office runs SolarWinds Web Help Desk, ask IT to upgrade to 2026.1 or later and check for compromise; compromised systems also need unauthorised access removed and affected credentials reset.","product":"SolarWinds Web Help Desk","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2025-40551"],"tags":["solarwinds","web-help-desk","remote-code-execution","actively-exploited"],"affected":["SolarWinds Web Help Desk 12.8.8 HF1 and all previous versions"],"fixed":["SolarWinds Web Help Desk 2026.1"],"matches":[],"sources":[{"kind":"advisory","title":"SolarWinds Trust Center Security Advisories: CVE-2025-40551","url":"https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40551","by":"SolarWinds","date":"2026-02-06"},{"kind":"advisory","title":"WHD 2026.1 release notes","url":"https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm","by":"SolarWinds","date":"2026-01-28"},{"kind":"research","title":"Multiple Critical SolarWinds Web Help Desk Vulnerabilities","url":"https://www.rapid7.com/blog/post/etr-multiple-critical-solarwinds-web-help-desk-vulnerabilities-cve-2025-40551-40552-40553-40554/","by":"Rapid7","date":"2026-01-28"},{"kind":"research","title":"Analysis of active exploitation of SolarWinds Web Help Desk","url":"https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/","by":"Microsoft","date":"2026-02-06"},{"kind":"research","title":"SolarWinds Web Help Desk Exploitation - February 2026","url":"https://security-labs.elastic.co/security-labs/solarwinds-whd-exploitation","by":"Elastic Security Labs","date":"2026-02-10"}],"started":"2026-02-03","closed":"2026-02-10","created":"2026-11-03T22:32:15.069Z","updated":"2026-11-03T22:32:15.069Z","cve_notes":[{"cve":"CVE-2025-40551","name":"Untrusted data deserialisation in Web Help Desk","what":"SolarWinds Web Help Desk processes untrusted data unsafely, allowing a remote attacker to run commands on its server without logging in.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-02-10","added":"2026-11-03T22:23:31.291Z","kind":"other","text":"Elastic published detection and recovery guidance for the reported Web Help Desk intrusions, recommending patching, credential rotation and checks for unauthorised remote access. It said the exact vulnerabilities used remained uncertain and it had not observed the activity in its own telemetry.","url":"https://security-labs.elastic.co/security-labs/solarwinds-whd-exploitation","by":"Elastic Security Labs","patch":null},{"at":"2026-02-06","added":"2026-11-03T22:23:31.291Z","kind":"disclosed","text":"Microsoft reported Web Help Desk intrusions from December 2025 involving remote access and credential theft. It could not establish which Web Help Desk vulnerability enabled entry, so these cases do not independently confirm use of CVE-2025-40551.","url":"https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/","by":"Microsoft","patch":null},{"at":"2026-02-06","added":"2026-11-03T22:23:31.291Z","kind":"vendor-revised","text":"SolarWinds updated its advisory to acknowledge the CISA listing and provide signs of compromise for administrators to check.","url":"https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40551","by":"SolarWinds","patch":null},{"at":"2026-02-03","added":"2026-11-03T22:23:31.291Z","kind":"cisa-added","text":"CISA added CVE-2025-40551 to its Known Exploited Vulnerabilities catalogue, confirming evidence of attacks.","url":"https://www.rapid7.com/blog/post/etr-multiple-critical-solarwinds-web-help-desk-vulnerabilities-cve-2025-40551-40552-40553-40554/","by":"Rapid7","patch":null},{"at":"2026-01-28","added":"2026-11-03T22:23:31.291Z","kind":"new-fix","text":"SolarWinds released Web Help Desk 2026.1, fixing CVE-2025-40551. The flaw lets an attacker run commands on the server without logging in.","url":"https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm","by":"SolarWinds","patch":"patched"}],"url":"https://hard.fyi/live/solarwinds-web-help-desk-attacks-jan-2026/","json":"https://hard.fyi/api/live?id=solarwinds-web-help-desk-attacks-jan-2026"}