SolarWinds Web Help Desk Deserialization RCE - CISA KEV

Key facts for SolarWinds WHD deserialization RCE

Detection coverage for SolarWinds WHD deserialization RCE

As of 2026-02-03, Threadlinqs Intelligence publishes 30 detection rule(s) for TL-2026-0060 across Splunk SPL, Microsoft KQL and Sigma, covering 69 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SolarWinds WHD Deserialization Exploit Detection

Detects suspicious Java deserialization patterns in Web Help Desk logs

• Languages: Splunk SPL, Microsoft KQL
• Data sources: solarwinds, application
• Severity: critical
• Confidence: high

Splunk SPL

index=solarwinds sourcetype="webhelpdesk:logs" 
| rex field=_raw "(?<suspicious_class>org\.apache\.commons\.collections\.|ysoserial\.|com\.sun\.org\.apache\.xalan)"
| where isnotnull(suspicious_class)
| stats count by host, suspicious_class, _time
| where count > 0

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceProduct has "SolarWinds" or ApplicationProtocol has "WHD"
| where Message has_any ("ysoserial", "CommonsCollections", "Jdk7u21", "Spring1", "URLDNS")
| project TimeGenerated, SourceIP, DestinationIP, Message

Known false positives:

• Legitimate use of Apache Commons Collections (rare in logs)

Tuning notes: None needed - these patterns indicate exploitation

• 🔒 SolarWinds WHD CVE-2025-40551 — CSRF Bypass via badparam Parameter · unlock with TL Creds
• 🔒 SolarWinds WHD JSONRPC Bridge Access via /wo/ Path Bypass · unlock with TL Creds
• 🔒 SolarWinds WHD — JNDI Outbound Connection from Java Process · unlock with TL Creds
• 🔒 SolarWinds WHD — Default Credentials Login Attempt (client/client) · unlock with TL Creds
• 🔒 SolarWinds WHD — Deserialization Error in jabsorb JSONRPCBridge · unlock with TL Creds
• 🔒 SolarWinds WHD — Known Attacker IP Access · unlock with TL Creds
• 🔒 SolarWinds WHD CVE-2025-40551 — Full Exploit Chain Detection · unlock with TL Creds
• 🔒 Java Process Spawning Shell — Potential JNDI RCE · unlock with TL Creds
• 🔒 SolarWinds WHD — Whitelist Bypass Payload Detection · unlock with TL Creds
• 🔒 SolarWinds WHD Unexpected Child Processes · unlock with TL Creds
• 🔒 SolarWinds WHD Network Anomaly · unlock with TL Creds
• 🔒 SolarWinds WHD Exploit Chain — Web Request Correlation · unlock with TL Creds
• 🔒 Java Process JNDI Exploitation — Shell Spawning and Outbound LDAP · unlock with TL Creds
• 🔒 SolarWinds WHD Default Credentials Usage and Privilege Escalation · unlock with TL Creds
• 🔒 SolarWinds WHD CVE-2025-40551 — Exploitation Parameters in Web Requests · unlock with TL Creds
• 🔒 SolarWinds WHD jabsorb Deserialization and Whitelist Bypass in Application Logs · unlock with TL Creds
• 🔒 SolarWinds WHD Java Process Spawning Shell — JNDI RCE Indicator · unlock with TL Creds
• 🔒 SolarWinds WHD CSRF Bypass and WebObject Component Creation · unlock with TL Creds
• 🔒 SolarWinds WHD JSONRPC Deserialization via /wo/ Path Bypass · unlock with TL Creds
• 🔒 SolarWinds WHD JNDI Outbound Connection and Known Attacker IPs · unlock with TL Creds
• 🔒 SolarWinds WHD JSONRPC Bridge Error in Application Logs — Deserialization Exploitation · unlock with TL Creds
• 🔒 SolarWinds WHD Hardcoded Credentials Login — CVE-2025-40537 client:client · unlock with TL Creds
• 🔒 Connections from Known WHD Exploitation IPs — SolarWinds Advisory IOCs · unlock with TL Creds
• 🔒 SolarWinds WHD Access Log Exploitation Indicators — [indicator]/badparam/wopage Patterns · unlock with TL Creds
• 🔒 OAST/DNS Callback from SolarWinds WHD Server — JNDI Exploitation Confirmation · unlock with TL Creds
• 🔒 SolarWinds WHD WebObjects Session Enumeration via Recording Header · unlock with TL Creds
• 🔒 SolarWinds WHD Exploit Chain — wopage Parameter and [indicator] in Request URI · unlock with TL Creds
• 🔒 SolarWinds WHD JSONRPC Deserialization Payload via /wo/ Path — CVE-2025-40551 · unlock with TL Creds
• 🔒 Outbound LDAP Connection from SolarWinds WHD Server — JNDI Exploitation · unlock with TL Creds

Indicators of compromise for SolarWinds WHD deserialization RCE

As of 2026-02-03, Threadlinqs Intelligence tracks 69 indicators of compromise for TL-2026-0060.

Sample indicators (2 of 69)

• IP address: 178.128.210[.]172
• IP address: 137.184.229[.]230

Defanged, TLP:CLEAR. Full set of 69 indicators: unlock with TL Creds.

How SolarWinds WHD deserialization RCE works

CISA KEV active exploitation confirmed. Attacker achieves unauthenticated RCE by: (1) establishing a session, (2) using wopage parameter to instantiate LoginPref component bypassing CSRF whitelist (CVE-2025-40536), (3) creating JSONRPC bridge endpoint, (4) sending jabsorb deserialization payload via /wo/ path to bypass /ajax/ sanitization, (5) triggering JNDI lookup for code execution. Additionally CVE-2025-40553 provides a second independent deserialization path, CVE-2025-40552 and CVE-2025-40554 provide authentication bypass, and CVE-2025-40537 provides hardcoded client:client credentials. Five CVEs disclosed Jan 28 2026, all fixed in WHD 2026.1. Discovered by Jimi Sebree (Horizon3.ai) and Piotr Bazydlo (watchTowr). WHD is deployed across enterprises, government, education, and healthcare for IT service management. Same SolarWinds ecosystem as ARM (TL-0016).

SolarWinds Web Help Desk (WHD) is an IT service management and help desk ticketing platform used by enterprises, government agencies, educational institutions, and healthcare organizations to manage IT support workflows, asset tracking, SLA management, and change management. WHD has been plagued by a recurring chain of Java deserialization vulnerabilities in its AjaxProxy JSONRPC bridge component, each a patch bypass of the previous fix.

The vulnerability chain began with CVE-2024-28986 (Aug 2024, CISA KEV Aug 15 2024), a Java deserialization RCE in the AjaxProxy functionality. SolarWinds patched it in WHD 12.8.3 HF1. Trend Micro ZDI discovered the patch was bypassable (CVE-2024-28988, Oct 2024, fixed in 12.8.3 HF3). That patch was again bypassed (CVE-2025-26399, Sep 2025, fixed in 12.8.7 HF1 — described as 'AjaxProxy Deserialization of Untrusted Data'). Now CVE-2025-40551 (Jan 28 2026) bypasses that patch too, requiring WHD 2026.1 to fix.

Horizon3.ai's Jimi Sebree provided a detailed technical writeup of the CVE-2025-40551 exploit chain:

1. **Session Establishment**: Attacker sends GET to /helpdesk/WebObjects/Helpdesk.woa, extracts session ID (X-Webobjects-Session-Id), XSRF token, and JSESSIONID.

2. **Security Control Bypass (CVE-2025-40536)**: WHD's CSRF check function checkCsrfTokenWo() validates query parameters against a whitelist. Including a bogus URI parameter with value '/ajax/' bypasses this. The 'wopage' parameter allows direct component instantiation: GET /helpdesk/WebObjects/Helpdesk.woa/wo/bogus.wo/{wosid}/1.0?badparam=/ajax/&wopage=LoginPref creates a LoginPref WebObject component with AjaxProxy instance.

3. **JSONRPC Bridge Creation**: The LoginPref component instantiates AjaxFlexibleFileUpload which provides JSONRPC bridge access. The JSONRPC endpoint URL is extractable from the response.

4. **Sanitization Bypass**: Previous patches added sanitization to 'params' and 'fixups' fields for requests containing 'ajax' in the URI. Simply changing /ajax/ to /wo/ in the request path bypasses this entirely because the WebObjects request handler is nearly identical. Additionally, the blacklist in checkSuspeciousPayload() [sic — typo in SolarWinds code] is bypassed via the isWhitelisted() function by including whitelisted terms early in the JSON payload.

5. **Deserialization RCE (CVE-2025-40551)**: The jabsorb JSON-RPC library dynamically loads and executes component actions. Using org.apache.xalan.lib.sql.JNDIConnectionPool with a malicious JNDI path triggers code execution. While newer WHD versions removed C3P0 libraries (previous gadgets), other classpath classes still enable RCE.

Compounding vulnerabilities disclosed the same day (Jan 28 2026): - **CVE-2025-40553** (CVSS 9.8): Second independent deserialization RCE, discovered by Piotr Bazydlo/watchTowr - **CVE-2025-40552** (CVSS 9.8): Authentication bypass allowing execution of protected actions, discovered by Bazydlo/watchTowr - **CVE-2025-40554** (CVSS 9.8): Another authentication bypass variant - **CVE-2025-40537** (CVSS 7.5): Hardcoded credentials — default 'client:client' demo account persists in production, can escalate to administrator via tech account association

Previous WHD vulnerabilities: CVE-2024-28987 (CVSS 9.1, hardcoded credentials, CISA KEV), CVE-2024-28989 (cryptographic key management), CVE-2025-26400 (XXE injection), CVE-2024-45709 (local file read).

SolarWinds provided IOCs: OAST server calls in WHD logs (whd_yyyy-mm-dd.txt), requests with 'bogus' and 'badparam=/ajax/' keywords in access logs (whd_access_log_yyyy-mm-dd.txt). Suspicious IPs: 178.128.210.172, 137.184.229.230.

This is the same SolarWinds product ecosystem as TL-0016 (Access Rights Manager). WHD and ARM share the same vendor trust model: organizations deploy SolarWinds tools for infrastructure management, and both products have critical RCE vulnerabilities that compromise the managed infrastructure.

MITRE ATT&CK techniques by tactic:

collection

T1005 Data from Local System; T1074 Data Staged; T1213 Data from Information Repositories

discovery

T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1518 Software Discovery

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1078 Valid Accounts; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth

exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1559 Inter-Process Communication

privilege-escalation

T1068 Exploitation for Privilege Escalation

command-and-control

T1071 Application Layer Protocol; T1090 Proxy; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer

persistence

T1098 Account Manipulation; T1136 Create Account; T1505 Server Software Component

credential-access

T1110 Brute Force; T1212 Exploitation for Credential Access; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

initial-access

T1190 Exploit Public-Facing Application

lateral-movement

T1210 Exploitation of Remote Services

impact

T1486 Data Encrypted for Impact; T1565 Data Manipulation

resource-development

T1583 Acquire Infrastructure; T1587 Develop Capabilities

reconnaissance

T1595 Active Scanning

Remediation for SolarWinds WHD deserialization RCE

Patches

• CVE-2025-40551: Fixed in WHD 2026.1 (Jan 28 2026)
• CVE-2025-40553: Fixed in WHD 2026.1 (Jan 28 2026) and WHD 12.8.8 HF2
• CVE-2025-40552: Fixed in WHD 2026.1 (Jan 28 2026)
• CVE-2025-40554: Fixed in WHD 2026.1 (Jan 28 2026)
• CVE-2025-40537: Fixed in WHD 2026.1 (Jan 28 2026)
• CVE-2025-40536: Fixed in WHD 2026.1 (Jan 28 2026)
• CVE-2025-26399: Fixed in WHD 12.8.7 HF1 (Sep 17 2025)
• CVE-2024-28988: Fixed in WHD 12.8.3 HF3 (Oct 15 2024)
• CVE-2024-28986: Fixed in WHD 12.8.3 HF1 (Aug 9 2024)

Immediate actions

• Upgrade SolarWinds Web Help Desk to version 2026.1 immediately — this is the ONLY version that addresses all 5 CVEs (CVE-2025-40551, CVE-2025-40553, CVE-2025-40552, CVE-2025-40554, CVE-2025-40537)
• If immediate upgrade is not possible: restrict WHD network access to trusted admin IPs only via firewall rules — WHD should NEVER be internet-facing
• Change default client:client credentials immediately (CVE-2025-40537) and audit all WHD user accounts for unauthorized accounts
• Review WHD logs for IOCs: search whd_access_log for 'bogus' and 'badparam=/ajax/' patterns, search whd logs for 'org.jabsorb.JSONRPCBridge - exception occured', and check for connections from 178.128.210.172 and 137.184.229.230

Workarounds

• Network-restrict WHD to trusted internal IPs only — block all external access
• Deploy WAF/IPS rules to block requests containing 'wopage=' parameter and 'badparam=/ajax/' in query strings
• Block JNDI/LDAP outbound connections from WHD server to untrusted destinations
• Disable the default client account or change its password from 'client'
• Monitor WHD logs for JSONRPC errors and OAST callbacks

Longer-term hardening

• Evaluate SolarWinds WHD deployment necessity — 4 deserialization bypasses in 18 months indicates fundamental architectural weakness in the AjaxProxy/jabsorb/WebObjects stack
• Deploy WAF rules blocking requests to WHD containing 'wopage=', 'badparam=/ajax/', and JSONRPC payloads with JNDI references
• Implement network segmentation: WHD should be on an isolated management VLAN with strict access controls
• Monitor SolarWinds Trust Center for future WHD advisories — the deserialization vulnerability surface may produce additional bypasses
• Consider alternative ITSM platforms if patching cadence cannot be maintained

Affected and fixed versions

• SolarWinds — Web Help Desk
  Vulnerable versions: < 2026.1
  Fixed in: 2026.1+

Timeline of SolarWinds WHD deserialization RCE

Showing the 20 most recent tracked events.

• 2024-08-22 CVE-2024-28987 disclosed: WHD hardcoded credentials vulnerability (CVSS 9.1). Allows unauthenticated access to internal functionality. Fixed in WHD 12.8.3 HF2. Later added to CISA KEV. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987
• 2024-10-15 CVE-2024-28988 disclosed: FIRST patch bypass of CVE-2024-28986. Discovered by Guy Lederfein of Trend Micro ZDI. Unauthenticated deserialization RCE via AjaxProxy. Fixed in WHD 12.8.3 HF3. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28988
• 2024-10-22 CVE-2024-28988 disclosed — first patch bypass of CVE-2024-28986 deserialization fix. AjaxProxy exploitation continues via new vector. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28988
• 2025-02-11 CVE-2024-28989 disclosed: WHD cryptographic key management vulnerability. Indicates broader security design issues in WHD codebase. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28989
• 2025-07-29 CVE-2025-26400 disclosed: WHD XML External Entity Injection (XXE) vulnerability. Yet another input validation failure in WHD. Fixed in WHD 12.8.7. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26400
• 2025-09-10 CVE-2025-26399 disclosed — second patch bypass discovered. SolarWinds releases another fix attempt for the same AjaxProxy deserialization issue. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399
• 2025-09-17 CVE-2025-26399 disclosed: SECOND patch bypass (bypass of CVE-2024-28988). Unauthenticated AjaxProxy deserialization RCE. Discovered anonymously via Trend Micro ZDI. Fixed in WHD 12.8.7 HF1. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399
• 2025-12-05 Horizon3.ai (Jimi Sebree) discloses CVE-2025-40551 + CVE-2025-40536 + CVE-2025-40537 to SolarWinds PSIRT. Same-day acknowledgment. This is the THIRD bypass of the original deserialization fix. Source: Horizon3.ai disclosure timeline
• 2025-12-12 SolarWinds PSIRT confirms report validity and provides incident ticket number. Source: Horizon3.ai disclosure timeline
• 2026-01-28 SolarWinds WHD 2026.1 released. First major version bump from 12.x line. Addresses all 5 new CVEs plus ongoing deserialization architecture issues. Source: https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
• 2026-01-28 Horizon3.ai publishes detailed technical writeup of CVE-2025-40551 exploit chain: session establishment → wopage parameter CSRF bypass → LoginPref component instantiation → JSONRPC bridge creation → /wo/ path sanitization bypass → jabsorb deserialization via JNDIConnectionPool → RCE. Includes Nuclei detection template. Source: https://horizon3.ai/attack-research/cve-2025-40551-another-solarwinds-web-help-desk-deserialization-issue/
• 2026-01-28 FIVE new WHD CVEs disclosed simultaneously: CVE-2025-40551 (deserialization RCE, CVSS 9.8, Horizon3.ai), CVE-2025-40553 (deserialization RCE, CVSS 9.8, watchTowr), CVE-2025-40552 (auth bypass, CVSS 9.8, watchTowr), CVE-2025-40554 (auth bypass, CVSS 9.8), CVE-2025-40537 (hardcoded creds, CVSS 7.5, Horizon3.ai), CVE-2025-40536 (security control bypass, CVSS 8.1, Horizon3.ai). All fixed in WHD 2026.1. Source: https://www.solarwinds.com/trust-center/security-advisories
• 2026-01-28 Horizon3.ai publishes full technical analysis with exploit chain details, Nuclei template, and IOC guidance. Documents 6-step exploitation flow from unauthenticated access to JNDI RCE. Source: https://horizon3.ai/attack-research/cve-2025-40551-another-solarwinds-web-help-desk-deserialization-issue/
• 2026-01-28 SolarWinds releases WHD 2026.1 fixing CVE-2025-40551, CVE-2025-40536, CVE-2025-40537, and 3 additional CVEs from watchTowr (CVE-2025-40552, CVE-2025-40553, CVE-2025-40554). JABSORB dependency removed entirely. Source: https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
• 2026-02-03 CVE-2025-40551 added to CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed. Federal remediation deadline Feb 24 2026. Fourth WHD deserialization CVE in CISA KEV.
• 2026-02-03 CISA adds CVE-2025-40551 to Known Exploited Vulnerabilities catalog with emergency 3-day remediation deadline (2026-02-06). Ransomware exploitation status: Unknown. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40551
• 2026-02-06 CISA KEV remediation deadline for CVE-2025-40551. Federal agencies required to have applied WHD 2026.1 or discontinued use. Unusually short 3-day window indicates severity assessment. Source: CISA KEV
• 2026-02-10 SolarWinds updates WHD 2026.1 release notes (last updated Feb 10, 2026). Includes new modern UI option alongside classic interface. Source: SolarWinds documentation
• 2026-02-11 ThreadLinqs Intelligence TL-2026-0060 research completed. WHD classified as CRITICAL: serial deserialization failures (4 patch bypasses in 18 months), 5 simultaneous CVSS 9.8 CVEs, CISA KEV active exploitation, management tool attack surface pattern.
• 2026-05-29 As of 2026-05-29, CVE-2025-40551 is patched in WHD 2026.1 (Jan 28 2026) but remains an actively-exploited CISA KEV entry (added Feb 3) with a public PoC and confirmed multi-stage intrusions (Microsoft, Huntress, RH-ISAC: Zoho RMM, Velociraptor, DCSync). The unattributed campaign against internet-facing unpatched WHD instances shows no takedown or conclusion, so exploitation risk persists for laggards.

Sources cited for SolarWinds WHD deserialization RCE

Showing 15 of 16 sources, primary sources first.

• CISA KEV: CVE-2025-40551 CISA · Government advisory · 2026-02-03
• NVD: CVE-2025-40551 NVD (NIST) · Advisory · 2026-01-28
• CVE.org: CVE-2025-40551 CVE Program · Advisory · 2026-01-28
• NVD — CVE-2024-28986 WHD Java Deserialization (Original, CISA KEV) NVD (NIST) · Advisory · 2024-08-09
• SolarWinds Trust Center: CVE-2025-40551 Advisory solarwinds.com · Vendor report · 2026-01-28
• SolarWinds WHD 2026.1 Release Notes documentation.solarwinds.com · Vendor report · 2026-01-28
• SolarWinds Advisory: CVE-2024-28986 (original vuln) solarwinds.com · Vendor report · 2024-08-13
• SolarWinds Advisory: CVE-2024-28988 (first bypass) solarwinds.com · Vendor report · 2024-10-22
• SolarWinds Advisory: CVE-2025-26399 (second bypass) solarwinds.com · Vendor report · 2025-09-10
• SolarWinds Advisory — CVE-2025-40551 WHD Deserialization RCE (CISA KEV) solarwinds.com · Vendor report · 2026-01-28
• SolarWinds Advisory — CVE-2025-40553 WHD Deserialization RCE (watchTowr) solarwinds.com · Vendor report · 2026-01-28
• SolarWinds Advisory — CVE-2025-40552 WHD Authentication Bypass solarwinds.com · Vendor report · 2026-01-28
• SolarWinds Advisory — CVE-2025-40536 WHD Security Control Bypass solarwinds.com · Vendor report · 2026-01-28
• SolarWinds Advisory — CVE-2024-28987 WHD Hardcoded Credentials solarwinds.com · Vendor report · 2024-08-22
• SolarWinds Trust Center — Complete Security Advisories solarwinds.com · Vendor report · 2026-01-28

Threats related to SolarWinds WHD deserialization RCE

• Critical React Native Vulnerability Actively Exploited in the Wild