VulnerabilitycriticalExploited in the wild

SolarWinds Fixes Four Critical Web Help Desk Flaws With Unauthenticated RCE and Auth Bypass

The Hacker Newsby @TheHackersNewsMar 2, 2026 · 06:04 UTC (Mar 2, 2026)3 min read1

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2025-40536 CVE-2025-40537 CVE-2025-40551 CVE-2025-40552 CVE-2025-40553 CVE-2025-40554 CVE-2024-28986 CVE-2024-28987 CVE-2024-28988 CVE-2025-26399

Tags: cve-2025-40536 cve-2025-40537 cve-2025-40551 cve-2025-40552 cve-2025-40553 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2024-28986	Java Deserialization RCE in SolarWinds Web Help Desk	9.8	85%	KEV	Aug 13, 2024 KEV Aug 15, 2024
CVE-2024-28987	Hardcoded Credential in SolarWinds Web Help Desk Allows Unauthenticated Access	9.1	93%	KEV	Aug 21, 2024 KEV Oct 15, 2024
CVE-2024-28988	Unauthenticated Java Deserialization RCE in SolarWinds Web Help Desk	9.8	39%		Sep 1, 2025
CVE-2025-26399	Unauthenticated Deserialization RCE in SolarWinds Web Help Desk	9.8	91%	KEVRansomware	Sep 23, 2025 KEV Mar 9, 2026
CVE-2025-40551 +5 related CVEs CVE-2025-40536 CVE-2025-40553 CVE-2025-40554 CVE-2025-40552 CVE-2025-40537	Unauthenticated Deserialization RCE in SolarWinds Web Help Desk	9.8 group max	84%	KEV	Jan 28, 2026 KEV Feb 3, 2026

From the original article

3 min read at thehackernews.com

 Ravie Lakshmanan  Jan 29, 2026 Vulnerability / Software Security SolarWinds has released security updates to address multiple security vulnerabilities impacting SolarWinds Web Help Desk, including four critical vulnerabilities that could result in authentication bypass and remote code execution (RCE). CVE-2025-40536 (CVSS score: 8.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.