Critical SolarWinds Web Help Desk flaw allows code execution without login

SolarWinds has published a security advisory for CVE-2025-40551, a critical vulnerability in Web Help Desk that allows unauthenticated attackers to execute code on the host system. It stems from deserialisation of untrusted data, so crafted input can be used to run arbitrary commands without prior access or credentials. The flaw affects version 12.8.8 HF1 and earlier and carries a CVSS score of 9.8. It is fixed in Web Help Desk 2026.1, and upgrading is urgent.

What this means for your organisation

A help desk platform holds user requests, attachments, contact details and often administrative access to other systems. When a flaw requires no login, the only thing standing between an attacker and the server is whether the service is reachable from outside. Code execution here yields both a foothold in the network and a collection of personal data, and a compromise will in many cases trigger GDPR notification duties. Organisations covered by the Digital Security Act or NIS2 may have to report significant incidents under the rules that apply to them.

Berigo recommends

• Upgrade to Web Help Desk 2026.1 now, and temporarily remove external access to the service if the upgrade has to wait.
• Confirm whether the instance has been reachable from the internet, and review logs for unexpected activity.
• Review what access the help desk service holds to other systems and tighten it to what is genuinely needed.
• Have the notification routine ready so deadlines under GDPR, and where applicable under the Digital Security Act or NIS2, can be met if something did happen.