Live › vulnerability › CVE-2025-40552
Go to dashboardSolarWinds Web Help Desk has an authentication bypass caused by improper identity token validation in its authentication module. An unauthenticated attacker can get past the security filters and reach the management console with administrative control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:12 UTC, 0h before NVD. All times on this page are UTC.
Teams running SolarWinds Web Help Desk before 2026.1 are in scope. The sources do not say which configurations are exposed, so treat any internet-reachable management console as affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| solarwinds web help desk | vendor | < 2026.1 | 2026.1 |
2026.1; the sources do not give a command or file path to read it.2026.1 or later.SolarWinds - Auth Bypass - CVE:CVE-2025-40552 in Block mode if traffic passes through Cloudflare.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-04-07 · Changelog
New updates and improvements at Cloudflare.
April 7, 2026
This week's release introduces new detections for a critical Remote Code Execution (RCE) vulnerability in MCP Server (CVE-2026-23744), alongside targeted protection for an authentication bypass vulnerability in SolarWinds products (CVE-2025-40552). Additionally, this release includes a new generic detection rule designed to identify and block Cross-Site Scripting (XSS) injection attempts leveraging "OnEvent" handlers within HTTP cookies.
Key Findings
Impact
Successful exploitation of the MCP Server and SolarWinds vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain administrative control, leading to a full system takeover. Additionally, the new generic XSS detection prevents attackers from leveraging browser event handlers in cookies to hijack user sessions or execute malicious scripts.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...0aa410af | N/A | Generic Rules - Command Execution - 5 - Body | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...9131ec2f | N/A | Generic Rules - Command Execution - 5 - Header | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...551eb9e5 | N/A | Generic Rules - Command Execution - 5 - URI | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...d46229eb | N/A | MCP Server - Remote Code Execution - CVE:CVE-2026-23744 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...a864b9c2 | N/A | XSS - OnEvents - Cookies | Log |
This page as .md · .json · in your agent: get_signal("CVE-2025-40552")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
| Block |
| This is a new detection. |
| Cloudflare Managed Ruleset | ...9712a863 | N/A | SQLi - Evasion - Body | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...40732d48 | N/A | SQLi - Evasion - Headers | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...e68a99b5 | N/A | SQLi - Evasion - URI | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...3e8143d2 | N/A | SQLi - LIKE 3 - Body | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...70e7fb97 | N/A | SQLi - LIKE 3 - URI | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...4c538bd9 | N/A | SQLi - UNION - 2 - Body | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...61c439c9 | N/A | SQLi - UNION - 2 - URI | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...cf33ea10 | N/A | SolarWinds - Auth Bypass - CVE:CVE-2025-40552 | Log | Block | This is a new detection. |