CVE-2025-40537CWE-798

SolarWinds Web Help Desk Hardcoded Credentials Vulnerability

High · published January 28, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
47.7
In the wild
Unconfirmed
What it is

⚡ A hardcoded credential vulnerability in SolarWinds Web Help Desk could potentially open the door to administrative functions with minimal effort! 🔓 Think of it like having a universal remote control for a hotel room—once someone gets their hands on it, they can adjust the thermostat, unlock the door, and even change the TV channel without any fuss. This flaw is just as concerning! An attacker exploiting this vulnerability could gain administrative access, allowing them to modify settings, view sensitive information, or wreak havoc on the system. The consequences could be absolutely devastating for any organization relying on this software!

Put simply

Think of it like having a universal remote control for a hotel room—once someone gets their hands on it, they can adjust the thermostat, unlock the door, and even change the TV channel without any fuss. This flaw is just as concerning! This vulnerability stems from hardcoded credentials within the SolarWinds Web Help Desk software that could be leveraged under certain conditions to bypass authentication checks, granting unauthorized administrative access.

What to do

An attacker exploiting this vulnerability could gain administrative access, allowing them to modify settings, view sensitive information, or wreak havoc on the system. The consequences could be absolutely devastating for any organization relying on this software! To mitigate this risk, immediately review and update your SolarWinds Web Help Desk installation to the latest patched version. Additionally, conduct a security audit to ensure no unauthorized accounts have been created and limit access to trusted personnel only. You've got this! Follow these steps, and you'll safeguard your system in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00594 · 47.7th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-01-28T07:31Z
EPSS history
Timeline
  • 28 JAN 07:31Z
    SolarWinds Web Help Desk Hardcoded Credentials Vulnerability
    cvelistv5