{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40553", "assignerOrgId": "49f11609-934d-4621-84e6-e02e032104d6", "state": "PUBLISHED", "assignerShortName": "SolarWinds", "dateReserved": "2025-04-16T08:01:25.943Z", "datePublished": "2026-01-28T07:35:41.825Z", "dateUpdated": "2026-02-27T04:55:46.647Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Web Help Desk", "vendor": "SolarWinds", "versions": [{"status": "affected", "version": "12.8.8 HF1 and below"}]}], "credits": [{"lang": "en", "type": "reporter", "user": "00000000-0000-4000-9000-000000000000", "value": "Piotr Bazydlo working with watchTowr"}], "datePublic": "2026-01-28T07:35:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication."}], "value": "SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication."}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "49f11609-934d-4621-84e6-e02e032104d6", "shortName": "SolarWinds", "dateUpdated": "2026-01-28T07:35:41.825Z"}, "references": [{"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40553"}, {"tags": ["release-notes"], "url": "https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SolarWinds recommends customers upgrade to Web Help Desk version 2026.1."}], "value": "SolarWinds recommends customers upgrade to Web Help Desk version 2026.1."}], "source": {"discovery": "EXTERNAL"}, "title": "SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"references": [{"url": "https://github.com/watchtowrlabs/watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553/blob/main/watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553.py", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2025-40553"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T04:55:46.647Z"}}]}, "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2025-40553", "date": "2026-09-11", "epss": "0.6039", "percentile": "0.99087"}, "nvd": "{\"cve\":{\"id\":\"CVE-2025-40553\",\"sourceIdentifier\":\"psirt@solarwinds.com\",\"published\":\"2026-01-28T08:16:02.583\",\"lastModified\":\"2026-06-17T09:21:44.700\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.\"},{\"lang\":\"es\",\"value\":\"SolarWinds Web Help Desk fue encontrado susceptible a una vulnerabilidad de deserializaci\u00f3n de datos no confiables que podr\u00eda conducir a la ejecuci\u00f3n remota de c\u00f3digo, lo que permitir\u00eda a un atacante ejecutar comandos en la m\u00e1quina anfitriona. Esto podr\u00eda ser explotado sin autenticaci\u00f3n.\"}],\"affected\":[{\"source\":\"psirt@solarwinds.com\",\"affectedData\":[{\"vendor\":\"SolarWinds\",\"product\":\"Web Help Desk\",\"defaultStatus\":\"affected\",\"versions\":[{\"version\":\"12.8.8 HF1 and below\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@solarwinds.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-28T00:00:00+00:00\",\"id\":\"CVE-2025-40553\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"psirt@solarwinds.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-502\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2026.1\",\"matchCriteriaId\":\"F7CADB33-214C-441A-BB62-64811EBBEB29\"}]}]}],\"references\":[{\"url\":\"https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm\",\"source\":\"psirt@solarwinds.com\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40553\",\"source\":\"psirt@solarwinds.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/watchtowrlabs/watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553/blob/main/watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553.py\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}", "redhat_vex": {"current_release_date": "2026-03-27T08:41:04+00:00", "cve": "CVE-2025-40553", "id": "CVE-2025-40553", "initial_release_date": "2025-01-01T00:00:00+00:00", "product_status:known_not_affected": "1", "source": "Red Hat CSAF VEX", "status": "final", "title": "SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40553.json", "version": "3"}, "vulnrichment": {"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-40553\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-26T18:39:21.147369Z\"}}}], \"references\": [{\"url\": \"https://github.com/watchtowrlabs/watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553/blob/main/watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553.py\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-28T16:29:46.368Z\"}}], \"cna\": {\"title\": \"SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Piotr Bazydlo working with watchTowr\"}], \"impacts\": [{\"capecId\": \"CAPEC-586\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-586 Object Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"SolarWinds\", \"product\": \"Web Help Desk\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.8.8 HF1 and below\"}], \"defaultStatus\": \"affected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"SolarWinds recommends customers upgrade to Web Help Desk version 2026.1.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"SolarWinds recommends customers upgrade to Web Help Desk version 2026.1.\", \"base64\": false}]}], \"datePublic\": \"2026-01-28T07:35:00.000Z\", \"references\": [{\"url\": \"https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40553\"}, {\"url\": \"https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm\", \"tags\": [\"release-notes\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-502\", \"description\": \"CWE-502 Deserialization of Untrusted Data\"}]}], \"providerMetadata\": {\"orgId\": \"49f11609-934d-4621-84e6-e02e032104d6\", \"shortName\": \"SolarWinds\", \"dateUpdated\": \"2026-01-28T07:35:41.825Z\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2025-40553\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-27T04:55:46.647Z\", \"dateReserved\": \"2025-04-16T08:01:25.943Z\", \"assignerOrgId\": \"49f11609-934d-4621-84e6-e02e032104d6\", \"datePublished\": \"2026-01-28T07:35:41.825Z\", \"assignerShortName\": \"SolarWinds\"}", "dataType": "CVE_RECORD", "dataVersion": "5.2"}}}