Hardcoded Credentials Vulnerability in SolarWinds Web Help Desk
CVE-2025-40537

7.5HIGH

Key Information:

Vendor

Solarwinds
Status
Web Help Desk
Vendor
CVE Published:
28 January 2026

What is CVE-2025-40537?

SolarWinds Web Help Desk has been identified to have a hardcoded credentials vulnerability that can potentially grant unauthorized access to administrative functions. This vulnerability exists under specific situations where the hardcoded credentials are improperly managed, leading to significant security risks for affected users. Organizations utilizing this software should review their deployments and apply necessary updates to mitigate any potential threats.

Affected Version(s)

Web Help Desk 12.8.8 HF1 and below

References

https://www.solarwinds.com/trust-center/security-advisori...
vendor-advisorypatch
https://documentation.solarwinds.com/en/success_center/wh...
release-notes

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jimi Sebree working with Horizon3.ai
.