CISA Flags Actively Exploited SolarWinds Web Help Desk Flaw as Metasploit Adds Exploit Modules
CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including a critical SolarWinds Web Help Desk (WHD) security protection bypass tracked as CVE-2025-40536 (CVSS 9.8). The issue stems from flawed CSRF-check logic that relies on a whitelist of query parameters, which can be bypassed with crafted URI parameters to reach restricted functionality without authentication; SolarWinds patched the flaw in WHD 2026.1. CISA set an accelerated remediation deadline for U.S. Federal Civilian Executive Branch agencies, and Microsoft separately reported an active campaign targeting SolarWinds WHD but did not confirm whether CVE-2025-40536 was the specific vulnerability exploited.
Rapid7 reported that Metasploit added exploit module support for SolarWinds WHD vulnerabilities CVE-2025-40536 and CVE-2025-40551, enabling post-exploitation sessions running as NT AUTHORITY\SYSTEM when successful. This increases operational risk for unpatched environments by lowering the barrier to exploitation and reinforces the urgency of applying SolarWinds’ available fixes and validating exposure of WHD instances, particularly those reachable from untrusted networks.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
7 events from the most recent confirmed update back to the earliest known activity.
CISA sets federal remediation deadlines for newly listed KEV flaws
Under Binding Operational Directive 22-01, CISA required FCEB agencies to remediate the newly added vulnerabilities by set deadlines: February 15, 2026 for CVE-2025-40536 and March 5, 2026 for the other three flaws.
CISA adds four actively exploited flaws to the KEV catalog
CISA added CVE-2024-43468, CVE-2025-15556, CVE-2025-40536, and CVE-2026-20700 to its Known Exploited Vulnerabilities catalog, signaling active exploitation affecting Microsoft Configuration Manager, Notepad++, SolarWinds Web Help Desk, and Apple devices.
Rapid7 releases Metasploit module for SolarWinds Web Help Desk flaws
Rapid7 published a Metasploit Framework update that included a new exploit module for SolarWinds Web Help Desk vulnerabilities CVE-2025-40536 and CVE-2025-40551, capable of yielding a session running as NT AUTHORITY\SYSTEM.
Google TAG reports Apple zero-day to Apple
Google's Threat Analysis Group discovered and reported CVE-2026-20700 to Apple, indicating the flaw was identified during investigation of targeted exploitation that may be associated with nation-state or commercial spyware activity.
Apple ships updates for actively exploited zero-day CVE-2026-20700
Apple released security updates across iOS, iPadOS, macOS, watchOS, tvOS, and visionOS to fix CVE-2026-20700, a dyld memory corruption and buffer overflow issue allowing arbitrary code execution. Apple said the flaw had been exploited in an extremely sophisticated targeted attack.
SolarWinds patches Web Help Desk authentication bypass flaw
SolarWinds fixed CVE-2025-40536, a critical Web Help Desk security control bypass that can let attackers access restricted functions without authentication, in Web Help Desk version 2026.1.
Microsoft releases fix for Configuration Manager SQL injection flaw
Microsoft provided update KB29166583 to address CVE-2024-43468, a critical SQL injection vulnerability in Microsoft Configuration Manager that can be exploited unauthenticated against an internet-exposed endpoint and potentially escalated to remote code execution.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
4 references tracked. Mallory keeps watching after this page renders.
CISA adds SolarWinds, Microsoft, Apple, Notepad++ vulnerabilities to KEV catalog | SC Media
scworld.com
Open sourceCISA Issues Warning on Exploited SolarWinds, Notepad++, and Microsoft Vulnerabilities
news4hackers.com
Open sourceU.S. CISA adds SolarWinds Web Help Desk, Notepad++, Microsoft Configuration Manager, and Apple devices flaws to its Known Exploited Vulnerabilities catalog
securityaffairs.com
Open sourceMteasploit Wrap-Up 02/13/2026
rapid7.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA Orders Patching of Exploited SolarWinds Web Help Desk RCE (CVE-2025-40551)
The U.S. Cybersecurity and Infrastructure Security Agency (**CISA**) added **CVE-2025-40551**—a critical (CVSS 9.8) *SolarWinds Web Help Desk (WHD)* vulnerability—to its **Known Exploited Vulnerabilities (KEV)** catalog after confirming active exploitation. The flaw is described as **deserialization of untrusted data** that can enable **unauthenticated remote code execution**, potentially allowing full compromise of affected WHD servers; the issue was reported to SolarWinds by Horizon3.ai researcher **Jimi Sebree**. CISA also issued a directive requiring U.S. federal civilian agencies to patch CVE-2025-40551 by the stated deadline, and SolarWinds released a fix in *Web Help Desk* version **2026.1**. Reporting tied the bug to a prior WHD issue (**CVE-2024-28986**) and characterized CVE-2025-40551 as part of a sequence of vulnerabilities involving bypasses of earlier fixes; CISA’s KEV update also included additional exploited flaws in **Sangoma FreePBX** (including **CVE-2019-19006** and **CVE-2025-64328**) and **GitLab** (**CVE-2021-39935**, SSRF), expanding the set of vulnerabilities agencies must remediate under KEV timelines.
Jun 29, 2026
CISA Flags Actively Exploited Vulnerabilities in SolarWinds Web Help Desk and Major Platforms
**CISA added multiple vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog**, triggering mandatory remediation timelines for U.S. federal civilian agencies. The newly listed issues include an actively exploited flaw in **SolarWinds Web Help Desk** (`CVE-2025-40536`) with an accelerated patch deadline, alongside additional KEV additions affecting **Apple** platforms (iOS, macOS, tvOS, watchOS, visionOS), **Microsoft** products, and **Notepad++**. Apple stated it was aware of reports the issue “may have been exploited in an extremely sophisticated attack against specific targeted individuals,” with **Google Threat Analysis Group** credited with discovery, underscoring continued targeting of high-value users via mobile/endpoint zero-days. Separate reporting highlighted the broader operational context driving these directives: **Microsoft’s February security update** addressed **59 vulnerabilities**, including **six zero-days under active exploitation**, reinforcing that exploit timelines are compressing and patching is increasingly a “defense sprint.” In parallel, CISA also moved to reduce systemic exposure at the perimeter by ordering agencies to **remove unsupported network edge devices** (e.g., firewalls/routers) within a year, reflecting concern that end-of-support infrastructure and rapidly weaponized vulnerabilities are converging into a persistent, high-impact federal risk.
Jun 29, 2026
Active Exploitation of SolarWinds Web Help Desk Flaws Enables Remote Code Execution
SolarWinds warned that multiple vulnerabilities in **Web Help Desk** are being actively exploited, with reporting highlighting a critical flaw that can lead to **remote code execution** on exposed help-desk servers. Public references tie the activity to `CVE-2025-40554`, while additional SolarWinds advisories and third-party research point to related issues including `CVE-2025-40552`, `CVE-2025-40553`, and `CVE-2025-40536`, indicating a broader security problem affecting the product. Security researchers and defenders published proof-of-concept material and detection guidance shortly after disclosure, including a watchTowr repository focused on Web Help Desk exploitation and a GitHub Gist describing **uncommon process activity** associated with compromise. The combination of vendor advisories, media reporting, and public exploit research indicates that attackers moved quickly to weaponize the flaws, increasing risk for organizations that have not patched, isolated, or monitored SolarWinds Web Help Desk deployments.
Jul 1, 2026