CISA Adds Actively Exploited Solar Winds Web Help Desk RCE to KEV Catalog
Summary: CISA added CVE-2025-40551, a deserialization-of-untrusted-data flaw in SolarWinds Web Help Desk with a CVSS score of 9.8, to its Known Exploited Vulnerabilities catalog on Tuesday, flagging it as actively exploited and exploitable without authentication to run commands on the host. SolarWinds released fixes for it and five other flaws (CVE-2025-40536, CVE-2025-40537, CVE-2025-40552, CVE-2025-40553, and CVE-2025-40554) in WHD version 2026.1 last week, and there are currently no public reports on how the flaw is being weaponized, who the targets are, or the scale of the efforts.
What you should know: Federal Civilian Executive Branch agencies must patch CVE-2025-40551 by February 6, 2026 under Binding Operational Directive 22-01, and the source gives no detail on who is exploiting it or against whom - so the deadline is the only known constraint on a 9.8-severity flaw that needs no credentials to run commands on the host.