SolarWinds Web Help Desk Deserialization RCE - CISA KEV

SolarWinds Web Help Desk Deserialization RCE (TL-2026-0060) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-02-03. It has no confirmed attribution, affects SolarWinds Web Help Desk, references 1 CVE (CVE-2025-40551), maps to 41 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 30 detection rules and 69 indicators of compromise.

Key facts for TL-2026-0060

Threat ID
TL-2026-0060
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
MONITORING
Category
VULNERABILITY
First published
2026-02-03
Last reviewed
2026-02-03
Attribution confidence
NONE
Motivation
EXPLOITATION
Target sectors
Government, Education, Healthcare, Financial Services, Technology, Critical Infrastructure
Target regions
North America, Europe, Global
Detection rules
30
Indicators of compromise
69

SolarWinds Web Help Desk (WHD) unauthenticated Java deserialization remote code execution via AjaxProxy JSONRPC bridge, chained with security control bypass and hardcoded credentials. CVE-2025-40551 (CVSS 9.8) is the fourth deserialization RCE in WHD's AjaxProxy component, each a patch bypass of the previous (CVE-2024-28986 → CVE-2024-28988 → CVE-2025-26399 → CVE-2025-40551). CISA KEV active exploitation confirmed. Attacker achieves unauthenticated RCE by: (1) establishing a session, (2) using wopage parameter to instantiate LoginPref component bypassing CSRF whitelist (CVE-2025-40536), (3) creating JSONRPC bridge endpoint, (4) sending jabsorb deserialization payload via /wo/ path to bypass /ajax/ sanitization, (5) triggering JNDI lookup for code execution. Additionally CVE-2025-40553 provides a second independent deserialization path, CVE-2025-40552 and CVE-2025-40554 provide authentication bypass, and CVE-2025-40537 provides hardcoded client:client credentials. Five CVEs disclosed Jan 28 2026, all fixed in WHD 2026.1. Discovered by Jimi Sebree (Horizon3.ai) and Piotr Bazydlo (watchTowr). WHD is deployed across enterprises, government, education, and healthcare for IT service management. Same SolarWinds ecosystem as ARM (TL-0016).

How SolarWinds Web Help Desk Deserialization RCE works

SolarWinds Web Help Desk (WHD) is an IT service management and help desk ticketing platform used by enterprises, government agencies, educational institutions, and healthcare organizations to manage IT support workflows, asset tracking, SLA management, and change management. WHD has been plagued by a recurring chain of Java deserialization vulnerabilities in its AjaxProxy JSONRPC bridge component, each a patch bypass of the previous fix.

The vulnerability chain began with CVE-2024-28986 (Aug 2024, CISA KEV Aug 15 2024), a Java deserialization RCE in the AjaxProxy functionality. SolarWinds patched it in WHD 12.8.3 HF1. Trend Micro ZDI discovered the patch was bypassable (CVE-2024-28988, Oct 2024, fixed in 12.8.3 HF3). That patch was again bypassed (CVE-2025-26399, Sep 2025, fixed in 12.8.7 HF1 — described as 'AjaxProxy Deserialization of Untrusted Data'). Now CVE-2025-40551 (Jan 28 2026) bypasses that patch too, requiring WHD 2026.1 to fix.

Horizon3.ai's Jimi Sebree provided a detailed technical writeup of the CVE-2025-40551 exploit chain:

1. **Session Establishment**: Attacker sends GET to /helpdesk/WebObjects/Helpdesk.woa, extracts session ID (X-Webobjects-Session-Id), XSRF token, and JSESSIONID.

2. **Security Control Bypass (CVE-2025-40536)**: WHD's CSRF check function checkCsrfTokenWo() validates query parameters against a whitelist. Including a bogus URI parameter with value '/ajax/' bypasses this. The 'wopage' parameter allows direct component instantiation: GET /helpdesk/WebObjects/Helpdesk.woa/wo/bogus.wo/{wosid}/1.0?badparam=/ajax/&wopage=LoginPref creates a LoginPref WebObject component with AjaxProxy instance.

3. **JSONRPC Bridge Creation**: The LoginPref component instantiates AjaxFlexibleFileUpload which provides JSONRPC bridge access. The JSONRPC endpoint URL is extractable from the response.

4. **Sanitization Bypass**: Previous patches added sanitization to 'params' and 'fixups' fields for requests containing 'ajax' in the URI. Simply changing /ajax/ to /wo/ in the request path bypasses this entirely because the WebObjects request handler is nearly identical. Additionally, the blacklist in checkSuspeciousPayload() [sic — typo in SolarWinds code] is bypassed via the isWhitelisted() function by including whitelisted terms early in the JSON payload.

5. **Deserialization RCE (CVE-2025-40551)**: The jabsorb JSON-RPC library dynamically loads and executes component actions. Using org.apache.xalan.lib.sql.JNDIConnectionPool with a malicious JNDI path triggers code execution. While newer WHD versions removed C3P0 libraries (previous gadgets), other classpath classes still enable RCE.

Compounding vulnerabilities disclosed the same day (Jan 28 2026): - **CVE-2025-40553** (CVSS 9.8): Second independent deserialization RCE, discovered by Piotr Bazydlo/watchTowr - **CVE-2025-40552** (CVSS 9.8): Authentication bypass allowing execution of protected actions, discovered by Bazydlo/watchTowr - **CVE-2025-40554** (CVSS 9.8): Another authentication bypass variant - **CVE-2025-40537** (CVSS 7.5): Hardcoded credentials — default 'client:client' demo account persists in production, can escalate to administrator via tech account association

Previous WHD vulnerabilities: CVE-2024-28987 (CVSS 9.1, hardcoded credentials, CISA KEV), CVE-2024-28989 (cryptographic key management), CVE-2025-26400 (XXE injection), CVE-2024-45709 (local file read).

SolarWinds provided IOCs: OAST server calls in WHD logs (whd_yyyy-mm-dd.txt), requests with 'bogus' and 'badparam=/ajax/' keywords in access logs (whd_access_log_yyyy-mm-dd.txt). Suspicious IPs: 178.128.210.172, 137.184.229.230.

This is the same SolarWinds product ecosystem as TL-0016 (Access Rights Manager). WHD and ARM share the same vendor trust model: organizations deploy SolarWinds tools for infrastructure management, and both products have critical RCE vulnerabilities that compromise the managed infrastructure.

MITRE ATT&CK techniques used in TL-2026-0060

collection

T1005 Data from Local System; T1074 Data Staged; T1213 Data from Information Repositories

discovery

T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1087 Account Discovery; T1518 Software Discovery

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1078 Valid Accounts; T1140 Deobfuscate/Decode Files or Information; T1211 Exploitation for Stealth

exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1559 Inter-Process Communication

privilege-escalation

T1068 Exploitation for Privilege Escalation

command-and-control

T1071 Application Layer Protocol; T1090 Proxy; T1095 Non-Application Layer Protocol; T1105 Ingress Tool Transfer

persistence

T1098 Account Manipulation; T1136 Create Account; T1505 Server Software Component

credential-access

T1110 Brute Force; T1212 Exploitation for Credential Access; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

initial-access

T1190 Exploit Public-Facing Application

lateral-movement

T1210 Exploitation of Remote Services

impact

T1486 Data Encrypted for Impact; T1565 Data Manipulation

resource-development

T1583 Acquire Infrastructure; T1587 Develop Capabilities

reconnaissance

T1595 Active Scanning

Affected products and versions in SolarWinds Web Help Desk Deserialization RCE

  • SolarWinds — Web Help Desk
    Vulnerable versions: < 2026.1
    Fixed in: 2026.1+

Remediation for SolarWinds Web Help Desk Deserialization RCE

Patches

  • CVE-2025-40551: Fixed in WHD 2026.1 (Jan 28 2026)
  • CVE-2025-40553: Fixed in WHD 2026.1 (Jan 28 2026) and WHD 12.8.8 HF2
  • CVE-2025-40552: Fixed in WHD 2026.1 (Jan 28 2026)
  • CVE-2025-40554: Fixed in WHD 2026.1 (Jan 28 2026)
  • CVE-2025-40537: Fixed in WHD 2026.1 (Jan 28 2026)
  • CVE-2025-40536: Fixed in WHD 2026.1 (Jan 28 2026)
  • CVE-2025-26399: Fixed in WHD 12.8.7 HF1 (Sep 17 2025)
  • CVE-2024-28988: Fixed in WHD 12.8.3 HF3 (Oct 15 2024)
  • CVE-2024-28986: Fixed in WHD 12.8.3 HF1 (Aug 9 2024)

Immediate actions

  • Upgrade SolarWinds Web Help Desk to version 2026.1 immediately — this is the ONLY version that addresses all 5 CVEs (CVE-2025-40551, CVE-2025-40553, CVE-2025-40552, CVE-2025-40554, CVE-2025-40537)
  • If immediate upgrade is not possible: restrict WHD network access to trusted admin IPs only via firewall rules — WHD should NEVER be internet-facing
  • Change default client:client credentials immediately (CVE-2025-40537) and audit all WHD user accounts for unauthorized accounts
  • Review WHD logs for IOCs: search whd_access_log for 'bogus' and 'badparam=/ajax/' patterns, search whd logs for 'org.jabsorb.JSONRPCBridge - exception occured', and check for connections from 178.128.210.172 and 137.184.229.230

Workarounds

  • Network-restrict WHD to trusted internal IPs only — block all external access
  • Deploy WAF/IPS rules to block requests containing 'wopage=' parameter and 'badparam=/ajax/' in query strings
  • Block JNDI/LDAP outbound connections from WHD server to untrusted destinations
  • Disable the default client account or change its password from 'client'
  • Monitor WHD logs for JSONRPC errors and OAST callbacks

Longer-term hardening

  • Evaluate SolarWinds WHD deployment necessity — 4 deserialization bypasses in 18 months indicates fundamental architectural weakness in the AjaxProxy/jabsorb/WebObjects stack
  • Deploy WAF rules blocking requests to WHD containing 'wopage=', 'badparam=/ajax/', and JSONRPC payloads with JNDI references
  • Implement network segmentation: WHD should be on an isolated management VLAN with strict access controls
  • Monitor SolarWinds Trust Center for future WHD advisories — the deserialization vulnerability surface may produce additional bypasses
  • Consider alternative ITSM platforms if patching cadence cannot be maintained

CVEs associated with SolarWinds Web Help Desk Deserialization RCE

CVE-2025-40551

Weaknesses (CWE) in SolarWinds Web Help Desk Deserialization RCE

CWE-502

Timeline of SolarWinds Web Help Desk Deserialization RCE

Showing the 20 most recent tracked events.

  • CVE-2024-28987 disclosed: WHD hardcoded credentials vulnerability (CVSS 9.1). Allows unauthenticated access to internal functionality. Fixed in WHD 12.8.3 HF2. Later added to CISA KEV. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987
  • CVE-2024-28988 disclosed: FIRST patch bypass of CVE-2024-28986. Discovered by Guy Lederfein of Trend Micro ZDI. Unauthenticated deserialization RCE via AjaxProxy. Fixed in WHD 12.8.3 HF3. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28988
  • CVE-2024-28988 disclosed — first patch bypass of CVE-2024-28986 deserialization fix. AjaxProxy exploitation continues via new vector. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28988
  • CVE-2024-28989 disclosed: WHD cryptographic key management vulnerability. Indicates broader security design issues in WHD codebase. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28989
  • CVE-2025-26400 disclosed: WHD XML External Entity Injection (XXE) vulnerability. Yet another input validation failure in WHD. Fixed in WHD 12.8.7. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26400
  • CVE-2025-26399 disclosed — second patch bypass discovered. SolarWinds releases another fix attempt for the same AjaxProxy deserialization issue. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399
  • CVE-2025-26399 disclosed: SECOND patch bypass (bypass of CVE-2024-28988). Unauthenticated AjaxProxy deserialization RCE. Discovered anonymously via Trend Micro ZDI. Fixed in WHD 12.8.7 HF1. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399
  • Horizon3.ai (Jimi Sebree) discloses CVE-2025-40551 + CVE-2025-40536 + CVE-2025-40537 to SolarWinds PSIRT. Same-day acknowledgment. This is the THIRD bypass of the original deserialization fix. Source: Horizon3.ai disclosure timeline
  • SolarWinds PSIRT confirms report validity and provides incident ticket number. Source: Horizon3.ai disclosure timeline
  • SolarWinds WHD 2026.1 released. First major version bump from 12.x line. Addresses all 5 new CVEs plus ongoing deserialization architecture issues. Source: https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
  • Horizon3.ai publishes detailed technical writeup of CVE-2025-40551 exploit chain: session establishment → wopage parameter CSRF bypass → LoginPref component instantiation → JSONRPC bridge creation → /wo/ path sanitization bypass → jabsorb deserialization via JNDIConnectionPool → RCE. Includes Nuclei detection template. Source: https://horizon3.ai/attack-research/cve-2025-40551-another-solarwinds-web-help-desk-deserialization-issue/
  • FIVE new WHD CVEs disclosed simultaneously: CVE-2025-40551 (deserialization RCE, CVSS 9.8, Horizon3.ai), CVE-2025-40553 (deserialization RCE, CVSS 9.8, watchTowr), CVE-2025-40552 (auth bypass, CVSS 9.8, watchTowr), CVE-2025-40554 (auth bypass, CVSS 9.8), CVE-2025-40537 (hardcoded creds, CVSS 7.5, Horizon3.ai), CVE-2025-40536 (security control bypass, CVSS 8.1, Horizon3.ai). All fixed in WHD 2026.1. Source: https://www.solarwinds.com/trust-center/security-advisories
  • Horizon3.ai publishes full technical analysis with exploit chain details, Nuclei template, and IOC guidance. Documents 6-step exploitation flow from unauthenticated access to JNDI RCE. Source: https://horizon3.ai/attack-research/cve-2025-40551-another-solarwinds-web-help-desk-deserialization-issue/
  • SolarWinds releases WHD 2026.1 fixing CVE-2025-40551, CVE-2025-40536, CVE-2025-40537, and 3 additional CVEs from watchTowr (CVE-2025-40552, CVE-2025-40553, CVE-2025-40554). JABSORB dependency removed entirely. Source: https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
  • CVE-2025-40551 added to CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed. Federal remediation deadline Feb 24 2026. Fourth WHD deserialization CVE in CISA KEV.
  • CISA adds CVE-2025-40551 to Known Exploited Vulnerabilities catalog with emergency 3-day remediation deadline (2026-02-06). Ransomware exploitation status: Unknown. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40551
  • CISA KEV remediation deadline for CVE-2025-40551. Federal agencies required to have applied WHD 2026.1 or discontinued use. Unusually short 3-day window indicates severity assessment. Source: CISA KEV
  • SolarWinds updates WHD 2026.1 release notes (last updated Feb 10, 2026). Includes new modern UI option alongside classic interface. Source: SolarWinds documentation
  • ThreadLinqs Intelligence TL-2026-0060 research completed. WHD classified as CRITICAL: serial deserialization failures (4 patch bypasses in 18 months), 5 simultaneous CVSS 9.8 CVEs, CISA KEV active exploitation, management tool attack surface pattern.
  • As of 2026-05-29, CVE-2025-40551 is patched in WHD 2026.1 (Jan 28 2026) but remains an actively-exploited CISA KEV entry (added Feb 3) with a public PoC and confirmed multi-stage intrusions (Microsoft, Huntress, RH-ISAC: Zoho RMM, Velociraptor, DCSync). The unattributed campaign against internet-facing unpatched WHD instances shows no takedown or conclusion, so exploitation risk persists for laggards.

Sources cited for SolarWinds Web Help Desk Deserialization RCE

Threats related to SolarWinds Web Help Desk Deserialization RCE

Detection coverage for TL-2026-0060

As of 2026-02-03, Threadlinqs Intelligence publishes 30 detection rule(s) for TL-2026-0060 across Splunk SPL, Microsoft KQL and Sigma, covering 69 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats