CISA Flags Actively Exploited SolarWinds Web Help Desk Flaw as Metasploit Adds Exploit Modules
CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including a critical SolarWinds Web Help Desk (WHD) security protection bypass tracked as CVE-2025-40536 (CVSS 9.8). The issue stems from flawed CSRF-check logic that relies on a whitelist of query parameters, which can be bypassed with crafted URI parameters to reach restricted functionality without authentication; SolarWinds patched the flaw in WHD 2026.1. CISA set an accelerated remediation deadline for U.S. Federal Civilian Executive Branch agencies, and Microsoft separately reported an active campaign targeting SolarWinds WHD but did not confirm whether CVE-2025-40536 was the specific vulnerability exploited.
Rapid7 reported that Metasploit added exploit module support for SolarWinds WHD vulnerabilities CVE-2025-40536 and CVE-2025-40551, enabling post-exploitation sessions running as NT AUTHORITY\SYSTEM when successful. This increases operational risk for unpatched environments by lowering the barrier to exploitation and reinforces the urgency of applying SolarWinds’ available fixes and validating exposure of WHD instances, particularly those reachable from untrusted networks.
Timeline
Feb 13, 2026
CISA sets federal remediation deadlines for newly listed KEV flaws
Under Binding Operational Directive 22-01, CISA required FCEB agencies to remediate the newly added vulnerabilities by set deadlines: February 15, 2026 for CVE-2025-40536 and March 5, 2026 for the other three flaws.
Feb 13, 2026
CISA adds four actively exploited flaws to the KEV catalog
CISA added CVE-2024-43468, CVE-2025-15556, CVE-2025-40536, and CVE-2026-20700 to its Known Exploited Vulnerabilities catalog, signaling active exploitation affecting Microsoft Configuration Manager, Notepad++, SolarWinds Web Help Desk, and Apple devices.
Feb 13, 2026
Rapid7 releases Metasploit module for SolarWinds Web Help Desk flaws
Rapid7 published a Metasploit Framework update that included a new exploit module for SolarWinds Web Help Desk vulnerabilities CVE-2025-40536 and CVE-2025-40551, capable of yielding a session running as NT AUTHORITY\SYSTEM.
Feb 13, 2026
Google TAG reports Apple zero-day to Apple
Google's Threat Analysis Group discovered and reported CVE-2026-20700 to Apple, indicating the flaw was identified during investigation of targeted exploitation that may be associated with nation-state or commercial spyware activity.
Feb 13, 2026
Apple ships updates for actively exploited zero-day CVE-2026-20700
Apple released security updates across iOS, iPadOS, macOS, watchOS, tvOS, and visionOS to fix CVE-2026-20700, a dyld memory corruption and buffer overflow issue allowing arbitrary code execution. Apple said the flaw had been exploited in an extremely sophisticated targeted attack.
Feb 13, 2026
SolarWinds patches Web Help Desk authentication bypass flaw
SolarWinds fixed CVE-2025-40536, a critical Web Help Desk security control bypass that can let attackers access restricted functions without authentication, in Web Help Desk version 2026.1.
Feb 13, 2026
Microsoft releases fix for Configuration Manager SQL injection flaw
Microsoft provided update KB29166583 to address CVE-2024-43468, a critical SQL injection vulnerability in Microsoft Configuration Manager that can be exploited unauthenticated against an internet-exposed endpoint and potentially escalated to remote code execution.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Vulnerabilities
Threat Actors
Organizations
Sources
Related Stories
CISA Orders Patching of Exploited SolarWinds Web Help Desk RCE (CVE-2025-40551)
The U.S. Cybersecurity and Infrastructure Security Agency (**CISA**) added **CVE-2025-40551**—a critical (CVSS 9.8) *SolarWinds Web Help Desk (WHD)* vulnerability—to its **Known Exploited Vulnerabilities (KEV)** catalog after confirming active exploitation. The flaw is described as **deserialization of untrusted data** that can enable **unauthenticated remote code execution**, potentially allowing full compromise of affected WHD servers; the issue was reported to SolarWinds by Horizon3.ai researcher **Jimi Sebree**. CISA also issued a directive requiring U.S. federal civilian agencies to patch CVE-2025-40551 by the stated deadline, and SolarWinds released a fix in *Web Help Desk* version **2026.1**. Reporting tied the bug to a prior WHD issue (**CVE-2024-28986**) and characterized CVE-2025-40551 as part of a sequence of vulnerabilities involving bypasses of earlier fixes; CISA’s KEV update also included additional exploited flaws in **Sangoma FreePBX** (including **CVE-2019-19006** and **CVE-2025-64328**) and **GitLab** (**CVE-2021-39935**, SSRF), expanding the set of vulnerabilities agencies must remediate under KEV timelines.
1 months ago
CISA Flags Actively Exploited Vulnerabilities in SolarWinds Web Help Desk and Major Platforms
**CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog**, triggering mandatory remediation timelines for U.S. federal civilian agencies. The newly listed issues include an actively exploited flaw in **SolarWinds Web Help Desk** (`CVE-2025-40536`) with an accelerated patch deadline, alongside additional KEV additions affecting **Apple** platforms (iOS, macOS, tvOS, watchOS, visionOS), **Microsoft** products, and **Notepad++**. Apple stated it was aware of reports the issue “may have been exploited in an extremely sophisticated attack against specific targeted individuals,” with **Google Threat Analysis Group** credited with discovery, underscoring continued targeting of high-value users via mobile/endpoint zero-days. Separate reporting highlighted the broader operational context driving these directives: **Microsoft’s February security update** addressed **59 vulnerabilities**, including **six zero-days under active exploitation**, reinforcing that exploit timelines are compressing and patching is increasingly a “defense sprint.” In parallel, CISA also moved to reduce systemic exposure at the perimeter by ordering agencies to **remove unsupported network edge devices** (e.g., firewalls/routers) within a year, reflecting concern that end-of-support infrastructure and rapidly weaponized vulnerabilities are converging into a persistent, high-impact federal risk.
1 months ago
Critical RCE and Authentication Bypass Vulnerabilities in SolarWinds Web Help Desk
SolarWinds released security updates for *Web Help Desk (WHD)* to address multiple critical vulnerabilities that could allow **unauthenticated remote attackers** to bypass authentication and achieve **remote code execution (RCE)**. The patched issues include two critical authentication bypass flaws, **CVE-2025-40552** and **CVE-2025-40554** (reported by watchTowr researcher Piotr Bazydlo), and two critical RCE flaws tied to **untrusted data deserialization**, **CVE-2025-40553** (Bazydlo) and **CVE-2025-40551** (reported by Horizon3.ai researcher Jimi Sebree), enabling remote command execution without prior access. SolarWinds also fixed a high-severity **hardcoded credentials** issue, **CVE-2025-40537**, which could enable unauthorized access to administrative functions under certain conditions. The vendor advised administrators to upgrade to **Web Help Desk 2026.1** and patch quickly, noting WHD has a history of being targeted and previously had vulnerabilities flagged as actively exploited by CISA, reinforcing the likelihood of rapid attacker interest following disclosure and patch availability.
1 months ago