Description
SolarWinds Web Help Desk 存在不可信数据反序列化漏洞。应用在处理外部输入数据时未对序列化对象进行充分的安全校验，攻击者可构造恶意序列化数据并发送至目标系统，在反序列化过程中触发恶意代码执行。该漏洞无需身份认证即可利用，最终可能导致远程代码执行。
SolarWinds Web Help Desk 代码执行漏洞（CVE-2025-40536/CVE-2025-40551）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
https://www.rapid7.com/blog/post/etr-multiple-critical-solarwinds-web-help-desk-vulnerabilities-cve-2025-40551-40552-40553-40554/
https://horizon3.ai/attack-research/cve-2025-40551-another-solarwinds-web-help-desk-deserialization-issue/
https://www.elastic.co/security-labs/solarwinds-whd-exploitation
https://ridgesecurity.ai/blog/a-deep-dive-into-the-critical-solarwinds-web-help-desk-vulnerability-cve-2025-40551/
https://nvd.nist.gov/vuln/detail/cve-2025-40551
https://www.sentinelone.com/vulnerability-database/cve-2025-40536/
https://www.sonicwall.com/blog/multiple-vulnerabilities-in-solarwinds-web-help-desk-leading-to-rce-cve-2025-40551
https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40551
https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
https://thehackernews.com/2026/02/cisa-adds-actively-exploited-solarwinds.html
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-40551.yaml