Cyber Resilience

CVE-2025-40537

High

Published: 28 January 2026

Published
28 January 2026
Modified
03 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0001 3.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-40537 is a high-severity Use of Hard-coded Credentials (CWE-798) vulnerability in Solarwinds Web Help Desk. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 3.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 IA-5 (Authenticator Management) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-40537, published on 2026-01-28, is a hardcoded credentials vulnerability (CWE-798) affecting SolarWinds Web Help Desk. The issue could allow access to administrative functions under certain situations. It has a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating network accessibility, high attack complexity, low privilege requirements, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability.

An authenticated attacker with low privileges can exploit this vulnerability over the network if they satisfy the high attack complexity conditions. Successful exploitation enables access to administrative functions, resulting in high-level compromise of confidentiality, integrity, and availability.

SolarWinds provides mitigation guidance in its security advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40537 and the Web Help Desk 2026.1 release notes at https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm.

EU & UK References

Vulnerability details

SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administrative functions.

CWE(s)
CWE-798

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
attack.mitre.org →
Why these techniques?

Hardcoded credentials (CWE-798) directly provide valid accounts for admin access and represent unsecured credentials stored in the application.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-40553Same product: Solarwinds Web Help Desk
CVE-2025-40552Same product: Solarwinds Web Help Desk
CVE-2025-26399Same product: Solarwinds Web Help Desk
CVE-2025-40554Same product: Solarwinds Web Help Desk
CVE-2025-40536Same product: Solarwinds Web Help Desk
CVE-2024-28988Same product: Solarwinds Web Help Desk
CVE-2025-40551Same product: Solarwinds Web Help Desk
CVE-2026-28299Same product: Solarwinds Web Help Desk
CVE-2024-52606Same product class: network monitoring / SIEM
CVE-2025-40540Same product class: network monitoring / SIEM

Affected Assets

solarwinds
web help desk
≤ 2026.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

IA-5 Authenticator Management good match
prevent

Directly prohibits hardcoded or embedded authenticators by requiring secure generation, distribution, and rotation of credentials instead of static administrative passwords.

AC-3 Access Enforcement partial match
prevent

Enforces validated access decisions so that even low-privilege authenticated sessions cannot reach administrative functions via the hardcoded credential path.

SI-2 Flaw Remediation good match
preventrecover

Requires timely application of the vendor patch (WHD 2026.1) that removes the hardcoded credential vulnerability.

References