Solar Winds Fixes Four Critical Web Help Desk Flaws With Unauthenticated RCE and Auth Bypass
Summary: SolarWinds released WHD 2026.1 to fix four critical Web Help Desk vulnerabilities, including CVE-2025-40551 and CVE-2025-40553, deserialization flaws that let an unauthenticated remote attacker achieve RCE and run arbitrary OS commands. CVE-2025-40552 and CVE-2025-40554 are authentication bypasses that Rapid7 says can also be chained to reach RCE, and watchTowr's Piotr Bazydlo found CVE-2025-40553 as a patch bypass for CVE-2025-26399, which itself bypassed CVE-2024-28988, a bypass of CVE-2024-28986.
Bottom line: CISA already added CVE-2024-28986 and CVE-2024-28987 to its KEV catalog citing active exploitation, and this is now the third patch bypass in the same product line - so the question is whether your Web Help Desk instance is on 2026.1 or still exposed to a chain that needs no credentials.