CVE-2025-40551

Katalog CVE

CVSS 9.8 · Critical KEV · sudah dieksploitasi EPSS 84,2%

Kerentanan Deserialization of Untrusted Data pada solarwinds web help desk. Skor CVSS 3.1 9.8 (Critical) menurut solarwinds.com. Masuk katalog KEV CISA pada 3 Februari 2026, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

Rincian

Terbit di NVD

28 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber solarwinds.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

84,2% peluang dieksploitasi; lebih tinggi dari 99,6% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Masuk KEV

3 Februari 2026

Tenggat CISA

6 Februari 2026 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40551 advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40551 pemerintah AS
• https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm release notes