CVE-2025-40536: SolarWinds Web Help Desk -- Security Control Bypass

Background

SolarWinds Web Help Desk (WHD) is an enterprise IT service management platform holding sensitive IT infrastructure data, service account credentials, and network topology information. It is frequently deployed in mid-size and enterprise environments for IT ticket tracking and asset management.

CVE-2025-40536 is a security control bypass vulnerability (CWE-693) in Web Help Desk that allows an unauthenticated attacker to access functionality that should require authentication or authorization. CISA added this to the KEV catalog on 2026-02-12, the same batch as companion vulnerability CVE-2025-40551 (deserialization RCE). The two vulnerabilities are likely chained together in active exploitation.

SolarWinds products have been under elevated scrutiny since the 2020 SUNBURST supply chain attack, and this second WHD vulnerability in the same CISA KEV batch reinforces that attackers actively target SolarWinds infrastructure management platforms for their high-value data and enterprise network access.

Technical Mechanism

CWE-693 (Protection Mechanism Failure) describes a failure to enforce a security control that should prevent access to sensitive functionality. In Web Help Desk, this manifests as insufficient authorization enforcement on API endpoints or administrative functions.

# Unauthenticated access to restricted WHD functionality
GET /helpdesk/WebObjects/Helpdesk.woa/ra/Tickets HTTP/1.1
Host: whd.enterprise.com
Accept: application/json
# Note: No Authorization header or session cookie required

# Response: Full ticket listing with sensitive infrastructure data
HTTP/1.1 200 OK
Content-Type: application/json
[{"ticketNumber":"1234","subject":"VPN credentials reset","body":"..."}]

The protection mechanism failure allows requests to sensitive WHD endpoints to succeed without presenting valid authentication credentials, exposing the full contents of the help desk system.

Real-World Exploitation Evidence

CISA’s KEV listing with a concurrent deserialization RCE (CVE-2025-40551) suggests these vulnerabilities are being chained: the security bypass provides unauthenticated access to the application, which enables delivery of the deserialization payload that achieves RCE. Help desk systems contain sensitive IT operational data routinely used in enterprise compromise operations — asset inventories, network diagrams, VPN credentials documented in tickets, and stored passwords for managed systems.

Impact Assessment

• Unauthenticated access to all help desk tickets, assets, and user data
• Exposure of sensitive IT credentials and network information stored in tickets
• Access to user account data, organizational structure, and IT infrastructure details
• When chained with CVE-2025-40551: full unauthenticated RCE on the WHD server
• High-value intelligence for targeted enterprise compromise

Affected Versions

Remediation Steps

1. Apply the SolarWinds Web Help Desk security patch addressing CVE-2025-40536 immediately.
2. Also apply the patch for CVE-2025-40551 in the same update cycle.
3. Restrict WHD access to internal networks only; never expose to the internet.
4. Audit WHD access logs for unauthorized data access before patching.
5. Rotate all credentials documented or stored in WHD tickets.
6. Implement network monitoring to alert on external access to WHD ports.

Detection Guidance

Log Sources: WHD access logs, network firewall logs, IDS/IPS.

IOCs: API requests to WHD endpoints without session tokens; bulk data retrieval from ticket or asset endpoints; access from external IP addresses to WHD management ports.

Sigma rule:

title: SolarWinds WHD Unauthenticated Access CVE-2025-40536
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/helpdesk/WebObjects/'
    sc-status: 200
  filter:
    cs-cookie|contains: 'wosid='
  condition: selection and not filter
level: critical

Timeline

References

• NVD — CVE-2025-40536
• CISA KEV — CVE-2025-40536
• SolarWinds Security Advisory — CVE-2025-40536