NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

SolarWinds Web Help Desk flaw CVE-2025-40551 used in attacks; fix available

Attackers are exploiting a flaw that lets them run commands on SolarWinds Web Help Desk servers without logging in. Organisations running version 12.8.8 HF1 or earlier should upgrade to 2026.1 or later and check for compromise.

What to do

Nothing to install on a family’s personal devices: this affects an organisation’s help-desk server. If your business or family office runs SolarWinds Web Help Desk, ask IT to upgrade to 2026.1 or later and check for compromise; compromised systems also need unauthorised access removed and affected credentials reset.

What’s happening

CVE-2025-40551 affects SolarWinds Web Help Desk, software organisations use to manage IT support tickets and equipment. Its handling of untrusted data can let a remote attacker run commands on the server without logging in. SolarWinds disclosed the flaw and released the fix in version 2026.1 on 28 January. CISA confirmed exploitation by adding it to its catalogue on 3 February, and SolarWinds subsequently published signs of compromise. Microsoft separately described Web Help Desk intrusions involving remote access and credential theft, but could not determine which vulnerability attackers used in those cases. Elastic reiterated that uncertainty on 10 February. As at 3 November, SolarWinds lists 12.8.8 HF1 and all earlier versions as affected and 2026.1 as fixed. The reviewed sources do not establish that attacks have ended. Updating closes this flaw; potentially compromised organisations also need investigation and recovery.

What
Flaw
Affects
SolarWinds Web Help Desk
Affected
SolarWinds Web Help Desk 12.8.8 HF1 and all previous versions
Fixed in
SolarWinds Web Help Desk 2026.1
CVE
CVE-2025-40551
Since
3 Feb 2026
Closed
10 Feb 2026

Timeline

  1. Update

    Elastic published detection and recovery guidance for the reported Web Help Desk intrusions, recommending patching, credential rotation and checks for unauthorised remote access. It said the exact vulnerabilities used remained uncertain and it had not observed the activity in its own telemetry.

  2. Made public

    Microsoft reported Web Help Desk intrusions from December 2025 involving remote access and credential theft. It could not establish which Web Help Desk vulnerability enabled entry, so these cases do not independently confirm use of CVE-2025-40551.

  3. Vendor revised

    SolarWinds updated its advisory to acknowledge the CISA listing and provide signs of compromise for administrators to check.

  4. CISA added

    CISA added CVE-2025-40551 to its Known Exploited Vulnerabilities catalogue, confirming evidence of attacks.

  5. New fixFixed

    SolarWinds released Web Help Desk 2026.1, fixing CVE-2025-40551. The flaw lets an attacker run commands on the server without logging in.

Sources

  1. SolarWinds Trust Center Security Advisories: CVE-2025-40551SolarWinds · 6 Feb 2026
  2. WHD 2026.1 release notesSolarWinds · 28 Jan 2026
  3. Multiple Critical SolarWinds Web Help Desk VulnerabilitiesRapid7 · 28 Jan 2026
  4. Analysis of active exploitation of SolarWinds Web Help DeskMicrosoft · 6 Feb 2026
  5. SolarWinds Web Help Desk Exploitation - February 2026Elastic Security Labs · 10 Feb 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from February 2026 · JSON · RSS