{"id":"CVE-2025-40552","kind":"vulnerability","aliases":["CVE-2025-40552"],"related":[],"title":"SolarWinds Web Help Desk: authentication bypass lets attackers reach admin console","description":"WAF Release - 2026-04-07 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nApril 7, 2026\n\n## WAF Release - 2026-04-07\n\nThis week's release introduces new detections for a critical Remote Code Execution (RCE) vulnerability in MCP Server (CVE-2026-23744), alongside targeted protection for an authentication bypass vulnerability in SolarWinds products (CVE-2025-40552). Additionally, this release includes a new generic detection rule designed to identify and block Cross-Site Scripting (XSS) injection attempts leveraging \"OnEvent\" handlers within HTTP cookies.\n\nKey Findings\n\n- MCP Server (CVE-2026-23744): A vulnerability in the Model Context Protocol (MCP) server implementation where malformed input payloads can trigger a memory corruption state, allowing for arbitrary code execution.\n- SolarWinds (CVE-2025-40552): A critical flaw in the authentication module allows unauthenticated attackers to bypass security filters and gain unauthorized access to the management console due to improper identity token validation.\n- XSS OnEvents Cookies: This generic rule identifies malicious event handlers (such as onload or onerror) embedded within HTTP cookie values.\n\nImpact\n\nSuccessful exploitation of the MCP Server and SolarWinds vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain administrative control, leading to a full system takeover. Additionally, the new generic XSS detection prevents attackers from leveraging browser event handlers in cookies to hijack user sessions or execute malicious scripts.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...0aa410af | N/A | Generic Rules - Command Execution - 5 - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...9131ec2f | N/A | Generic Rules - Command Execution - 5 - Header | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...551eb9e5 | N/A | Generic Rules - Command Execution - 5 - URI | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...d46229eb | N/A | MCP Server - Remote Code Execution - CVE:CVE-2026-23744 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...a864b9c2 | N/A | XSS - OnEvents - Cookies | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...9712a863 | N/A | SQLi - Evasion - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...40732d48 | N/A | SQLi - Evasion - Headers | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...e68a99b5 | N/A | SQLi - Evasion - URI | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...3e8143d2 | N/A | SQLi - LIKE 3 - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...70e7fb97 | N/A | SQLi - LIKE 3 - URI | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...4c538bd9 | N/A | SQLi - UNION - 2 - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...61c439c9 | N/A | SQLi - UNION - 2 - URI | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...cf33ea10 | N/A | SolarWinds - Auth Bypass - CVE:CVE-2025-40552 | Log | Block | This is a new detection. |","summary":"SolarWinds Web Help Desk has an authentication bypass caused by improper identity token validation in its authentication module. An unauthenticated attacker can get past the security filters and reach the management console with administrative control.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"solarwinds web help desk","fixed":["2026.1"],"affected":"< 2026.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cloudflare","lab-disclosure","other","solarwinds","web-help-desk"],"not_affected_if":["version-2026.1-or-later"],"how_to_check":"- Confirm the installed Web Help Desk version is below `2026.1`; the sources do not give a command or file path to read it.\n- unknown","fix":"- Upgrade SolarWinds Web Help Desk to `2026.1` or later.\n- Until the upgrade is done, enable the Cloudflare managed rule `SolarWinds - Auth Bypass - CVE:CVE-2025-40552` in Block mode if traffic passes through Cloudflare.","status":"open","published_at":"2026-01-28T08:16:02+00:00","first_seen_at":"2026-10-24T19:12:57+00:00","triaged_at":"2026-10-25T05:28:08+00:00","updated_at":"2026-10-25T05:28:08+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-25T05:28:08Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SolarWinds Web Help Desk to `2026.1` or later.\n- Until the upgrade is done, enable the Cloudflare managed rule `SolarWinds - Auth Bypass - CVE:CVE-2025-40552` in Block mode if traffic passes through Cloudflare.","reach":"unknown","title":"SolarWinds Web Help Desk: authentication bypass lets attackers reach admin console","impact":"high","summary":"SolarWinds Web Help Desk has an authentication bypass caused by improper identity token validation in its authentication module. An unauthenticated attacker can get past the security filters and reach the management console with administrative control.","category":"other","nicknames":[],"who_cares":["solarwinds","web-help-desk"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker gains administrative control of the management console.","analyst_note":"Confirm the exact affected version range and a version or config check against the SolarWinds advisory for CVE-2025-40552; the NVD description in the sources is truncated.","how_to_check":"- Confirm the installed Web Help Desk version is below `2026.1`; the sources do not give a command or file path to read it.\n- unknown","needs_analyst":true,"not_affected_if":["version-2026.1-or-later"],"who_is_affected":"Teams running SolarWinds Web Help Desk before 2026.1 are in scope. The sources do not say which configurations are exposed, so treat any internet-reachable management console as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00145,"input_tokens":4776,"output_tokens":1945,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-04':70C,86C '-07':71C,87C '-2025':13A,16A,121C,184C,508C '-2026':107C,155C,363C '-23744':108C,156C,364C '-40552':14A,17A,122C,185C,509C '0aa410af':300C '2':473C,489C '2026':69C,82C,85C '3':440C,457C '3e8143':435C '40732d48':405C '4c538bd9':469C '5':306C,324C,342C '551eb9e5':336C '61c439c9':485C '7':81C '70e7':452C '9131ec2f':318C '9712a863':390C 'a864b9c2':375C 'access':203C 'action':293C,295C 'addit':123C,262C 'admin':10A 'administr':65B,254C 'allow':177C,193C,245C 'alongsid':109C 'april':80C 'arbitrari':179C,250C 'attack':8A,52B,195C,247C,269C 'attempt':143C 'auth':504C 'authent':5A,38B,48B,114C,191C 'block':136C,345C,366C,381C,511C 'bodi':307C,394C,441C,474C 'browser':272C 'bypass':6A,39B,115C,197C,505C 'caus':40B 'cf33ea10':501C 'changelog':72C,73C 'cloudflar':22B,79C,297C,315C,333C,351C,372C,387C,402C,417C,432C,449C,466C,482C,498C 'code':99C,180C,251C,359C 'command':304C,322C,340C 'comment':296C 'consol':11A,63B,207C 'context':162C 'control':66B,255C 'cooki':149C,216C,232C,276C,379C 'corrupt':175C 'could':244C 'critic':97C,187C 'cross':138C 'cross-sit':137C 'cve':12A,15A,106C,120C,154C,183C,361C,362C,506C,507C 'd2':436C 'd46229eb':354C 'descript':291C 'design':132C 'desk':4A,21A,31B,35B 'detect':94C,130C,267C,314C,332C,350C,371C,386C,401C,416C,431C,448C,465C,481C,497C,516C 'disabl':309C,327C,396C,411C,426C,443C,460C,476C,492C 'disclosur':25B 'due':208C 'e68a99b5':420C 'embed':229C 'evas':393C,408C,423C 'event':222C,273C 'execut':100C,181C,249C,282C,305C,323C,341C,360C 'exploit':236C 'fb97':453C 'filter':58B,199C 'find':151C 'flaw':188C 'full':259C 'gain':201C,253C 'generic':129C,218C,265C,302C,320C,338C 'get':54B 'handler':146C,223C,274C 'header':325C,409C 'help':3A,20A,30B,34B 'hijack':278C 'http':148C,231C 'id':287C,290C 'ident':43B,211C 'identifi':134C,220C 'impact':234C 'implement':166C 'improp':42B,210C 'improv':77C 'includ':126C 'inject':142C 'input':169C 'introduc':92C 'key':150C 'lab':24B 'lab-disclosur':23B 'lead':256C 'legaci':288C 'let':7A 'leverag':144C,271C 'like':439C,456C 'log':308C,326C,344C,365C,380C,395C,410C,425C,442C,459C,475C,491C,510C 'malform':168C 'malici':221C,283C 'manag':62B,206C,298C,316C,334C,352C,373C,388C,403C,418C,433C,450C,467C,483C,499C 'mcp':104C,152C,164C,239C,356C 'memori':174C 'model':161C 'modul':49B,192C 'n/a':301C,319C,337C,355C,376C,391C,406C,421C,437C,454C,470C,486C,502C 'new':74C,93C,128C,264C,294C,313C,331C,349C,370C,385C,400C,415C,430C,447C,464C,480C,496C,515C 'onerror':228C 'onev':145C,215C,378C 'onload':226C 'past':55B 'payload':170C 'prevent':268C 'previous':292C 'product':119C 'protect':111C 'protocol':163C 'rce':101C 'reach':9A,60B 'releas':68C,84C,91C,125C 'remot':98C,358C 'rule':131C,219C,286C,289C,303C,321C,339C 'ruleset':285C,299C,317C,335C,353C,374C,389C,404C,419C,434C,451C,468C,484C,500C 'script':140C,284C 'secur':57B,198C 'server':105C,153C,165C,240C,357C 'session':280C 'site':139C 'solarwind':1A,27B,32B,118C,182C,242C,503C 'solarwinds':18A 'sqli':392C,407C,422C,438C,455C,471C,487C 'state':176C 'success':235C 'system':260C 'takeov':261C 'target':110C 'token':44B,212C 'trigger':172C 'unauthent':51B,194C,246C 'unauthor':202C 'union':472C,488C 'updat':75C 'uri':343C,424C,458C,490C 'user':279C 'valid':45B,213C 'valu':233C 'vulner':102C,116C,158C,243C 'waf':67C,83C 'web':2A,19A,29B,33B 'web-help-desk':28B 'week':89C 'within':147C,230C 'xss':141C,214C,266C,377C","nicknames":[],"mitigations":[],"who_affected":"Teams running SolarWinds Web Help Desk before 2026.1 are in scope. The sources do not say which configurations are exposed, so treat any internet-reachable management console as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-01-28T08:16:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@solarwinds.com","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-04-07-waf-release/#CVE-2025-40552","url":"https://developers.cloudflare.com/changelog/post/2026-04-07-waf-release/","severity":null,"published_at":"2026-04-07T19:12:03+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:12:57+00:00","fetched_at":"2026-10-24T19:12:57+00:00","note":"Cloudflare: WAF Release - 2026-04-07 · Changelog"},{"source":"nvd","external_id":"CVE-2025-40552","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-40552","severity":null,"published_at":"2026-01-28T08:16:02+00:00","modified_at":"2026-06-17T09:21:44+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","fetched_at":"2026-10-24T19:23:38+00:00","note":null}],"documents":[{"id":2922,"url":"https://developers.cloudflare.com/changelog/post/2026-04-07-waf-release/","title":"Cloudflare: WAF Release - 2026-04-07 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-04-07 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nApril 7, 2026\n\n## WAF Release - 2026-04-07\n\nThis week's release introduces new detections for a critical Remote Code Execution (RCE) vulnerability in MCP Server (CVE-2026-23744), alongside targeted protection for an authentication bypass vulnerability in SolarWinds products (CVE-2025-40552). Additionally, this release includes a new generic detection rule designed to identify and block Cross-Site Scripting (XSS) injection attempts leveraging \"OnEvent\" handlers within HTTP cookies.\n\nKey Findings\n\n- MCP Server (CVE-2026-23744): A vulnerability in the Model Context Protocol (MCP) server implementation where malformed input payloads can trigger a memory corruption state, allowing for arbitrary code execution.\n- SolarWinds (CVE-2025-40552): A critical flaw in the authentication module allows unauthenticated attackers to bypass security filters and gain unauthorized access to the management console due to improper identity token validation.\n- XSS OnEvents Cookies: This generic rule identifies malicious event handlers (such as onload or onerror) embedded within HTTP cookie values.\n\nImpact\n\nSuccessful exploitation of the MCP Server and SolarWinds vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain administrative control, leading to a full system takeover. Additionally, the new generic XSS detection prevents attackers from leveraging browser event handlers in cookies to hijack user sessions or execute malicious scripts.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...0aa410af | N/A | Generic Rules - Command Execution - 5 - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...9131ec2f | N/A | Generic Rules - Command Execution - 5 - Header | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...551eb9e5 | N/A | Generic Rules - Command Execution - 5 - URI | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...d46229eb | N/A | MCP Server - Remote Code Execution - CVE:CVE-2026-23744 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...a864b9c2 | N/A | XSS - OnEvents - Cookies | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...9712a863 | N/A | SQLi - Evasion - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...40732d48 | N/A | SQLi - Evasion - Headers | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...e68a99b5 | N/A | SQLi - Evasion - URI | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...3e8143d2 | N/A | SQLi - LIKE 3 - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...70e7fb97 | N/A | SQLi - LIKE 3 - URI | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...4c538bd9 | N/A | SQLi - UNION - 2 - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...61c439c9 | N/A | SQLi - UNION - 2 - URI | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...cf33ea10 | N/A | SolarWinds - Auth Bypass - CVE:CVE-2025-40552 | Log | Block | This is a new detection. |","published_at":"2026-04-07T19:12:03+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}