SolarWinds Web Help Desk security bypass CVE-2025-40536 used in attacks; fix available
Attackers are exploiting a security bypass in SolarWinds Web Help Desk 12.8.8 HF1 and earlier. Organisations running it should upgrade to 2026.1 or later and investigate possible compromise. This is an IT support server update.
If your business or family office runs SolarWinds Web Help Desk, ask its IT provider to upgrade to 2026.1 or later and check for signs of intrusion. Suspected compromises need investigation and credential resets as well as patching. Families who do not operate this server have no update to install.
What’s happening
CVE-2025-40536 lets someone without a login bypass a security protection and reach restricted functions in SolarWinds Web Help Desk, software organisations use to manage IT support tickets and assets. SolarWinds disclosed it on 28 January and supplied the fix in version 2026.1; version 12.8.8 HF1 and all earlier releases are affected. The vendor rates it High, with a score of 8.1. CISA confirmed exploitation by adding it to its catalogue on 12 February. Microsoft separately described December 2025 Web Help Desk intrusions involving credential theft and access to other systems, but could not identify the exact flaw used. Those intrusions therefore do not establish a December start for this CVE. As at 3 November, the vendor still identifies 2026.1 as the fixed release. Public reporting provides no detailed account of the CVE-specific attacks or confirmation that previously compromised systems have been cleared.
- What
- Flaw
- Affects
- SolarWinds Web Help Desk
- Affected
- SolarWinds Web Help Desk 12.8.8 HF1 and all previous versions
- Fixed in
- SolarWinds Web Help Desk 2026.1
- Since
- 12 Feb 2026
- Closed
- 13 Feb 2026
Timeline
- Update
The Record reported that US federal civilian agencies had until 15 February to patch this flaw, following CISA's unusually short remediation deadline.
- CISA added
CISA added CVE-2025-40536 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. The Canadian Centre for Cyber Security recorded the addition in its updated advisory.
- Update
Microsoft reported December 2025 intrusions through exposed Web Help Desk servers, followed by credential theft and movement into other systems. It could not confirm which vulnerability provided access, so these attacks cannot be attributed specifically to CVE-2025-40536.
- New fixFixed
SolarWinds released Web Help Desk 2026.1, fixing CVE-2025-40536. Its advisory identifies 12.8.8 HF1 and all earlier versions as affected.
Sources
- SolarWinds Web Help Desk Security Control Bypass Vulnerability (CVE-2025-40536)SolarWinds · 28 Jan 2026
- WHD 2026.1 release notesSolarWinds · 28 Jan 2026
- Analysis of active exploitation of SolarWinds Web Help DeskMicrosoft · 6 Feb 2026
- SolarWinds security advisory (AV26-063) - Update 2Canadian Centre for Cyber Security · 13 Feb 2026
- CISA orders federal agencies to patch exploited SolarWinds, Apple, Microsoft bugs within weeksThe Record · 13 Feb 2026
- CISA Warns of Exploited SolarWinds, Notepad++, Microsoft VulnerabilitiesSecurityWeek · 13 Feb 2026