InfoSecBulletin Cybersecurity for mankind
CISA announced on Tuesday that a security flaw in SolarWinds Web Help Desk is now listed in its Known Exploited Vulnerabilities catalog, indicating it is actively being targeted in attacks.
The vulnerability, CVE-2025-40551 (CVSS score: 9.8), allows untrusted data deserialization that could enable remote code execution.
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Web Help Desk is widely used by government agencies, large corporations, healthcare organizations, and schools. SolarWinds reports over 300,000 customers globally for its IT management products.
SolarWinds released fixes for a vulnerability last week, including CVE-2025-40536 (CVSS 8.1), CVE-2025-40537 (CVSS 7.5), CVE-2025-40552 (CVSS 9.8), CVE-2025-40553 (CVSS 9.8), and CVE-2025-40554 (CVSS 9.8), in WHD version 2026.1.
There are no public reports on how the vulnerability is being used in attacks, who the targets are, or the scale of these efforts. This highlights how fast threat actors exploit newly revealed flaws.
Also added to the KEV catalog are three other vulnerabilities:
CVE-2019-19006 (CVSS score: 9.8): A vulnerability in Sangoma FreePBX that lets unauthorized users access services without a password.
CVE-2025-64328 (CVSS score: 8): An OS command injection vulnerability in Sangoma FreePBX allows authenticated users to execute commands through the testconnection -> check_ssh_connect() function, potentially gaining remote access as an asterisk user.
CVE-2021-39935 (CVSS score: 7.5/6.8): A security flaw in GitLab that lets unauthorized users make requests to external servers through the CI Lint API.
GreyNoise reported the exploitation of CVE-2021-39935 in March 2025, amid increasing SSRF vulnerability abuses across platforms like DotNetNuke, Zimbra, VMware vCenter, DocumentLocator, BerriAI LiteLLM, and Ivanti Connect Secure.
