{"id":207727,"date":"2026-01-29T04:00:00","date_gmt":"2026-01-29T09:00:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/01\/29\/solarwinds-fixes-four-critical-web-help-desk-flaws-with-unauthenticated-rce-and-auth-bypass\/"},"modified":"2026-01-29T08:15:08","modified_gmt":"2026-01-29T13:15:08","slug":"solarwinds-fixes-four-critical-web-help-desk-flaws-with-unauthenticated-rce-and-auth-bypass","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/01\/29\/solarwinds-fixes-four-critical-web-help-desk-flaws-with-unauthenticated-rce-and-auth-bypass\/","title":{"rendered":"SolarWinds Fixes Four Critical Web Help Desk Flaws With Unauthenticated RCE and Auth Bypass"},"content":{"rendered":"<p><a href=\"https:\/\/thehackernews.com\/2026\/01\/solarwinds-fixes-four-critical-web-help.html\">SolarWinds Fixes Four Critical Web Help Desk Flaws With Unauthenticated RCE and Auth Bypass<\/a><\/p>\n<p><a href=\"https:\/\/thehackernews.com\/2026\/01\/solarwinds-fixes-four-critical-web-help.html\">https:\/\/thehackernews.com\/2026\/01\/solarwinds-fixes-four-critical-web-help.html<\/a><\/p>\n<p>Publish Date: <a href=\"publish_date]\">2026-01-29 04:00:00<\/a><\/p>\n<p>Source Domain: <a href=\"thehackernews.com\">thehackernews.com<\/a><\/p>\n<p><span class=\"p-author\">\ue804<span class=\"author\">Ravie Lakshmanan<\/span>\ue802<span class=\"author\">Jan 29, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ Software Security<\/span><\/p>\n<p>SolarWinds has released security updates to address multiple security vulnerabilities impacting SolarWinds Web Help Desk, including four critical vulnerabilities that could result in authentication bypass and remote code execution (RCE).<\/p>\n<p>The list of vulnerabilities is as follows &#8211;<\/p>\n<ul>\n<li><strong>CVE-2025-40536<\/strong> (CVSS score: 8.1) &#8211; A security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality<\/li>\n<li><strong>CVE-2025-40537<\/strong> (CVSS score: 7.5) &#8211; A hard-coded credentials vulnerability that could allow access to administrative functions using the &#8220;client&#8221; user account<\/li>\n<li><strong>CVE-2025-40551<\/strong> (CVSS score: 9.8) &#8211; An untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an unauthenticated attacker to run commands on the host machine<\/li>\n<li><strong>CVE-2025-40552<\/strong> (CVSS score: 9.8) &#8211; An authentication bypass vulnerability that could allow an unauthenticated attacker to execute actions and methods<\/li>\n<li><strong>CVE-2025-40553<\/strong> (CVSS score: 9.8) &#8211; An untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an unauthenticated attacker to run commands on the host machine<\/li>\n<li><strong>CVE-2025-40554<\/strong> (CVSS score: 9.8) &#8211; An authentication bypass vulnerability that could allow an attacker to invoke specific actions within Web Help Desk<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgqlhh16hjmE7NRyQeAR2_sLZ1uDwyQH2jkPHmDTAtveTHoIjCrfmK6JLqlZuNKOPG1RGLtwJk-ZJDwQiV-McwmzAUu1iOSwwMjs_tqI1KjcL_tCvc0M2XuKBPfJ1RXpKxnx-eGdWwM0wlNDnUYHvXr-1LZk2zRmDNLIEbYGalGQJsd6QwC0pyCrLavN0fz\/s728-e100\/threatlocker-inside-d.png\" width=\"729\" height=\"91\"\/><\/p>\n<p>While Jimi Sebree from Horizon3.ai has been credited with discovering and reporting the first three vulnerabilities, watchTowr&#8217;s Piotr Bazydlo has been acknowledged for the remaining three flaws. All the issues have been addressed in WHD 2026.1.<\/p>\n<p>&#8220;Both CVE-2025-40551 and CVE-2025-40553 are critical deserialization of untrusted data vulnerabilities that allow a remote unauthenticated attacker to achieve RCE on a target system and execute payloads such as arbitrary OS command execution,&#8221; Rapid7 said.<\/p>\n<p>&#8220;RCE via deserialization is a highly reliable vector for attackers to leverage, and as&#8230;<\/p>\n<p><a href=\"https:\/\/thehackernews.com\/2026\/01\/solarwinds-fixes-four-critical-web-help.html\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>SolarWinds Fixes Four Critical Web Help Desk Flaws With Unauthenticated RCE and Auth Bypass https:\/\/thehackernews.com\/2026\/01\/solarwinds-fixes-four-critical-web-help.html&#8230;<\/p>\n","protected":false},"author":1,"featured_media":207728,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj6GfPr6A1uY8KhmAw_BnWkdf6psUxmcTyTGGRQmw4LwX7cYRCH1CIS_hoATQj0ZLWSWI2brY2fVOsyx5vtncgWgg7D3KFpyIp4cazlOS1ByTGkRPY0ZjHBMelCGtrLsCktO8_bmIa48L8voQKre51yUDBaNY8qO_c-imAcN9Cj3FKLx3KQ12wYFxs0OOGV\/s1700-e365\/solarwinds.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[26,24,27],"class_list":["post-207727","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-ai","tag-cybersecurity","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/207727"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=207727"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/207727\/revisions"}],"predecessor-version":[{"id":207729,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/207727\/revisions\/207729"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/207728"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=207727"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=207727"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=207727"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}