--- id: "CVE-2025-40552" kind: "vulnerability" aliases: ["CVE-2025-40552"] title: "SolarWinds Web Help Desk: authentication bypass lets attackers reach admin console" severity: "critical" cvss: 9.8 epss: 0.51997 exploited: false status: "open" category: "other" products: [{"name": "solarwinds web help desk", "fixed": ["2026.1"], "affected": "< 2026.1", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["cloudflare", "lab-disclosure", "other", "solarwinds", "web-help-desk"] not_affected_if: ["version-2026.1-or-later"] published_at: "2026-01-28T08:16:02+00:00" first_seen_at: "2026-10-24T19:12:57+00:00" updated_at: "2026-10-25T12:38:49+00:00" sources: [{"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-04-07-waf-release/", "first_seen_at": "2026-10-24T19:12:57+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40552", "first_seen_at": "2026-10-24T19:23:38+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-40552", "first_seen_at": "2026-10-25T12:38:49+00:00"}] --- # SolarWinds Web Help Desk: authentication bypass lets attackers reach admin console SolarWinds Web Help Desk has an authentication bypass caused by improper identity token validation in its authentication module. An unauthenticated attacker can get past the security filters and reach the management console with administrative control. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:solarwinds web help desk affected < 2026.1 fixed 2026.1 ## How to check - Confirm the installed Web Help Desk version is below `2026.1`; the sources do not give a command or file path to read it. - unknown ## Fix - Upgrade SolarWinds Web Help Desk to `2026.1` or later. - Until the upgrade is done, enable the Cloudflare managed rule `SolarWinds - Auth Bypass - CVE:CVE-2025-40552` in Block mode if traffic passes through Cloudflare. ## Timeline - 2026-10-24T19:12:57+00:00 lab https://developers.cloudflare.com/changelog/post/2026-04-07-waf-release/ — Cloudflare: WAF Release - 2026-04-07 · Changelog - 2026-10-24T19:23:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-40552 - 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2025-40552 ## Documents - [advisory] Cloudflare: WAF Release - 2026-04-07 · Changelog https://developers.cloudflare.com/changelog/post/2026-04-07-waf-release/ ## From the sources WAF Release - 2026-04-07 · Changelog # Changelog New updates and improvements at Cloudflare. April 7, 2026 ## WAF Release - 2026-04-07 This week's release introduces new detections for a critical Remote Code Execution (RCE) vulnerability in MCP Server (CVE-2026-23744), alongside targeted protection for an authentication bypass vulnerability in SolarWinds products (CVE-2025-40552). Additionally, this release includes a new generic detection rule designed to identify and block Cross-Site Scripting (XSS) injection attempts leveraging "OnEvent" handlers within HTTP cookies. Key Findings - MCP Server (CVE-2026-23744): A vulnerability in the Model Context Protocol (MCP) server implementation where malformed input payloads can trigger a memory corruption state, allowing for arbitrary code execution. - SolarWinds (CVE-2025-40552): A critical flaw in the authentication module allows unauthenticated attackers to bypass security filters and gain unauthorized access to the management console due to improper identity token validation. - XSS OnEvents Cookies: This generic rule identifies malicious event handlers (such as onload or onerror) embedded within HTTP cookie values. Impact Successful exploitation of the MCP Server and SolarWinds vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain administrative control, leading to a full system takeover. Additionally, the new generic XSS detection prevents attackers from leveraging browser event handlers in cookies to hijack user sessions or execute malicious scripts. | Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments | | --- | --- | --- | --- | --- | --- | --- | | Cloudflare Managed Ruleset | ...0aa410af | N/A | Generic Rules - Command Execution - 5 - Body | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...9131ec2f | N/A | Generic Rules - Command Execution - 5 - Header | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...551eb9e5 | N/A | Generic Rules - Command Execution - 5 - URI | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...d46229eb | N/A | MCP Server - Remote Code Execution - CVE:CVE-2026-23744 | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...a864b9c2 | N/A | XSS - OnEvents - Cookies | Log | Block | This is a new detection. | | Cloudflare Managed Ruleset | ...9712a863 | N/A | SQLi - Evasion - Body | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...40732d48 | N/A | SQLi - Evasion - Headers | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...e68a99b5 | N/A | SQLi - Evasion - URI | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...3e8143d2 | N/A | SQLi - LIKE 3 - Body | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...70e7fb97 | N/A | SQLi - LIKE 3 - URI | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...4c538bd9 | N/A | SQLi - UNION - 2 - Body | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...61c439c9 | N/A | SQLi - UNION - 2 - URI | Log | Disabled | This is a new detection. | | Cloudflare Managed Ruleset | ...cf33ea10 | N/A | SolarWinds - Auth Bypass - CVE:CVE-2025-40552 | Log | Block | This is a new detection. | --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_