CVE-2025-40551: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that permits remote code execution without authentication. An attacker who reaches the affected service can run arbitrary commands on the underlying host. The issue matters because help-desk platforms often sit inside the corporate network and handle tickets that may contain sensitive operational data.

How it works

The weakness is categorized as CWE-502, deserialization of untrusted data. The application accepts serialized objects from an unauthenticated source and reconstructs them without sufficient validation. When the reconstructed object contains attacker-controlled instructions, the Java or .NET runtime executes those instructions, giving the attacker a foothold on the server. No special credentials or prior session are required for the initial request.

Am I affected? How to find it in your systems

SolarWinds Web Help Desk is typically deployed on-premises as a Tomcat-based web application or as a managed service. Inventory every instance by querying configuration-management databases, endpoint-management consoles, and network scans for the product’s default ports and installation paths. Compare the installed build against the versions listed in the vendor advisory; if the advisory does not explicitly state that a given build is fixed, treat the instance as potentially affected. Review web-access logs for unexpected POST or PUT requests to deserialization endpoints and monitor process-creation events on the host for anomalies such as cmd.exe or powershell.exe launched by the application account.

How to remediate

Apply the vendor-supplied update referenced in the official advisory. After patching, restrict inbound access to the Web Help Desk service to only the IP ranges that legitimately submit tickets. Disable any unused serialization formats or custom object handlers if the application configuration permits it. Confirm that the underlying operating-system account running the service follows the principle of least privilege.

If you can't patch immediately

Place the server behind a network segmentation boundary that prevents direct internet exposure and limits lateral movement to other internal systems. Where a web-application firewall is already in place, create a rule that drops requests containing common serialized-object signatures until the patch can be applied. If compensating controls cannot be implemented, follow the CISA directive to discontinue use of the product. Continue to monitor authentication and process logs for signs of exploitation while the exposure remains.

If your data may have been exposed

Remote-code-execution flaws of this class have been used to establish persistent access. Review authentication logs and any ticket attachments processed during the exposure window. You can run a free exposure scan of your organization’s email domains to check whether related credentials appear in known breach data.