InfoSecBulletin Cybersecurity for mankind
CISA announced on Tuesday that a security flaw in SolarWinds Web Help Desk is now listed in its Known Exploited Vulnerabilities catalog, indicating it is actively being targeted in attacks.
The vulnerability, CVE-2025-40551 (CVSS score: 9.8), allows untrusted data deserialization that could enable remote code execution.
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Web Help Desk is widely used by government agencies, large corporations, healthcare organizations, and schools. SolarWinds reports over 300,000 customers globally for its IT management products.
SolarWinds released fixes for a vulnerability last week, including CVE-2025-40536 (CVSS 8.1), CVE-2025-40537 (CVSS 7.5), CVE-2025-40552 (CVSS 9.8), CVE-2025-40553 (CVSS 9.8), and CVE-2025-40554 (CVSS 9.8), in WHD version 2026.1.
There are no public reports on how the vulnerability is being used in attacks, who the targets are, or the scale of these efforts. This highlights how fast threat actors exploit newly revealed flaws.
Also added to the KEV catalog are three other vulnerabilities:
CVE-2019-19006 (CVSS score: 9.8): A vulnerability in Sangoma FreePBX that lets unauthorized users access services without a password.
CVE-2025-64328 (CVSS score: 8): An OS command injection vulnerability in Sangoma FreePBX allows authenticated users to execute commands through the testconnection -> check_ssh_connect() function, potentially gaining remote access as an asterisk user.
CVE-2021-39935 (CVSS score: 7.5/6.8): A security flaw in GitLab that lets unauthorized users make requests to external servers through the CI Lint API.
GreyNoise reported the exploitation of CVE-2021-39935 in March 2025, amid increasing SSRF vulnerability abuses across platforms like DotNetNuke, Zimbra, VMware vCenter, DocumentLocator, BerriAI LiteLLM, and Ivanti Connect Secure.
