CVE-2025-40536Vulnerability
SolarWinds Web Help Desk Security Control Bypass Vulnerability
Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .
Reported by 2 independent sources · first reported by Huntress · last reported
Last reported 8 months ago
CISA KEVAdded 12 Feb 2026
Fix due 15 Feb 2026
Used by ransomware: not knownCISA KEV catalogue
Fix due 15 Feb 2026
Used by ransomware: not knownCISA KEV catalogue
EPSS73.6%
higher than 99% of CVEsFIRST EPSS, as of 23 Oct 2026
higher than 99% of CVEsFIRST EPSS, as of 23 Oct 2026
What the reports say
2 reports, newest first · the exact sentence from each-
SolarWinds Web Help Desk Exploitation - February 2026“While not yet confirmed, the activity may be associated with one of the following disclosed CVEs: CVE-2025-26399, CVE-2025-40536, and CVE-2025-40551”
-
Active Exploitation of SolarWinds Web Help Desk (CVE-2025-26399)“Update SolarWinds Web Help Desk to version 2026.1 or later, which addresses CVE-2025-26399, CVE-2025-40536, and CVE-2025-40551.”
Indicators reported together
named in the same reports- hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/v4.msiin 2 reports
- hxxps://files.catbox[.]moe/tmp9fc.msiin 2 reports
- hxxps://github[.]com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.msiin 2 reports
- hxxps://auth.qgtxtebl.workers[.]dev/in 1 report
- auth.qgtxtebl.workers[.]devin 1 report
- v2-api.mooo[.]comin 1 report
- worker[.]devin 1 report
- 897eae49e6c32de3…c85cd538a189in 1 report
- 46831be6e577e312…90396393b751in 1 report
- hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/code.txtin 1 report
- 34b2a6c334813adb…b13bbd2381f4in 1 report
- bbd6e120bf553091…b2edfa97ef44in 1 report
Copy these 12 indicators · defanged
Also named with it: CVE-2025-26399, CVE-2025-40551
Thanks — we review every report.