CVE-2025-40554
9.8
CRITICAL · CVSS 3.1 · EPSS 60.6% (pctl 99)
Patch early
EPSS 60.6% — above the 10% action threshold.
Description
SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 60.64% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-1390 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2026-01-28 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| solarwinds | web help desk |
References
→ the Explorer · watch your stack · NVD