# SolarWinds Web Help Desk Deserialization RCE - CISA KEV

> SolarWinds Web Help Desk (WHD) unauthenticated Java deserialization remote code execution via AjaxProxy JSONRPC bridge, chained with security control bypass and hardcoded credentials. CVE-2025-40551 (CVSS 9.8) is the fourth deserialization RCE in WHD's AjaxProxy component, each a patch bypass of the previous (CVE-2024-28986 → CVE-2024-28988 → CVE-2025-26399 → CVE-2025-40551). CISA KEV active exploitation confirmed. Attacker achieves unauthenticated RCE by: (1) establishing a session, (2) using wopage parameter to instantiate LoginPref component bypassing CSRF whitelist (CVE-2025-40536), (3) creating JSONRPC bridge endpoint, (4) sending jabsorb deserialization payload via /wo/ path to bypass /ajax/ sanitization, (5) triggering JNDI lookup for code execution. Additionally CVE-2025-40553 provides a second independent deserialization path, CVE-2025-40552 and CVE-2025-40554 provide authentication bypass, and CVE-2025-40537 provides hardcoded client:client credentials. Five CVEs disclosed Jan 28 2026, all fixed in WHD 2026.1. Discovered by Jimi Sebree (Horizon3.ai) and Piotr Bazydlo (watchTowr). WHD is deployed across enterprises, government, education, and healthcare for IT service management. Same SolarWinds ecosystem as ARM (TL-0016).

- **Published:** 2026-02-03T19:48:00Z
- **Last reviewed:** 2026-02-03T19:48:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0060
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-solarwinds-whd-deserialization-rce-tl-2026-0060.webp?v=46586097 (Threadlinqs threat intel: SolarWinds Web Help Desk Java RCE: Detection & IOCs (TL-2026-0060) — Critical severity, 69 IOCs, 30 detection rules.)
- **ID:** TL-2026-0060
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 30 (1 shown free below) · **IOCs:** 69 (2 shown free below)
- **CVEs:** CVE-2025-40551, CVE-2024-28986, CVE-2024-28987, CVE-2024-28988, CVE-2025-26399, CVE-2025-40536, CVE-2025-40537, CVE-2025-40552, CVE-2025-40553, CVE-2025-40554

## Description

SolarWinds Web Help Desk (WHD) is an IT service management and help desk ticketing platform used by enterprises, government agencies, educational institutions, and healthcare organizations to manage IT support workflows, asset tracking, SLA management, and change management. WHD has been plagued by a recurring chain of Java deserialization vulnerabilities in its AjaxProxy JSONRPC bridge component, each a patch bypass of the previous fix.

The vulnerability chain began with CVE-2024-28986 (Aug 2024, CISA KEV Aug 15 2024), a Java deserialization RCE in the AjaxProxy functionality. SolarWinds patched it in WHD 12.8.3 HF1. Trend Micro ZDI discovered the patch was bypassable (CVE-2024-28988, Oct 2024, fixed in 12.8.3 HF3). That patch was again bypassed (CVE-2025-26399, Sep 2025, fixed in 12.8.7 HF1 — described as 'AjaxProxy Deserialization of Untrusted Data'). Now CVE-2025-40551 (Jan 28 2026) bypasses that patch too, requiring WHD 2026.1 to fix.

Horizon3.ai's Jimi Sebree provided a detailed technical writeup of the CVE-2025-40551 exploit chain:

1. **Session Establishment**: Attacker sends GET to /helpdesk/WebObjects/Helpdesk.woa, extracts session ID (X-Webobjects-Session-Id), XSRF token, and JSESSIONID.

2. **Security Control Bypass (CVE-2025-40536)**: WHD's CSRF check function checkCsrfTokenWo() validates query parameters against a whitelist. Including a bogus URI parameter with value '/ajax/' bypasses this. The 'wopage' parameter allows direct component instantiation: GET /helpdesk/WebObjects/Helpdesk.woa/wo/bogus.wo/{wosid}/1.0?badparam=/ajax/&wopage=LoginPref creates a LoginPref WebObject component with AjaxProxy instance.

3. **JSONRPC Bridge Creation**: The LoginPref component instantiates AjaxFlexibleFileUpload which provides JSONRPC bridge access. The JSONRPC endpoint URL is extractable from the response.

4. **Sanitization Bypass**: Previous patches added sanitization to 'params' and 'fixups' fields for requests containing 'ajax' in the URI. Simply changing /ajax/ to /wo/ in the request path bypasses this entirely because the WebObjects request handler is nearly identical. Additionally, the blacklist in checkSuspeciousPayload() [sic — typo in SolarWinds code] is bypassed via the isWhitelisted() function by including whitelisted terms early in the JSON payload.

5. **Deserialization RCE (CVE-2025-40551)**: The jabsorb JSON-RPC library dynamically loads and executes component actions. Using org.apache.xalan.lib.sql.JNDIConnectionPool with a malicious JNDI path triggers code execution. While newer WHD versions removed C3P0 libraries (previous gadgets), other classpath classes still enable RCE.

Compounding vulnerabilities disclosed the same day (Jan 28 2026):
- **CVE-2025-40553** (CVSS 9.8): Second independent deserialization RCE, discovered by Piotr Bazydlo/watchTowr
- **CVE-2025-40552** (CVSS 9.8): Authentication bypass allowing execution of protected actions, discovered by Bazydlo/watchTowr
- **CVE-2025-40554** (CVSS 9.8): Another authentication bypass variant
- **CVE-2025-40537** (CVSS 7.5): Hardcoded credentials — default 'client:client' demo account persists in production, can escalate to administrator via tech account association

Previous WHD vulnerabilities: CVE-2024-28987 (CVSS 9.1, hardcoded credentials, CISA KEV), CVE-2024-28989 (cryptographic key management), CVE-2025-26400 (XXE injection), CVE-2024-45709 (local file read).

SolarWinds provided IOCs: OAST server calls in WHD logs (whd_yyyy-mm-dd.txt), requests with 'bogus' and 'badparam=/ajax/' keywords in access logs (whd_access_log_yyyy-mm-dd.txt). Suspicious IPs: 178.128.210.172, 137.184.229.230.

This is the same SolarWinds product ecosystem as TL-0016 (Access Rights Manager). WHD and ARM share the same vendor trust model: organizations deploy SolarWinds tools for infrastructure management, and both products have critical RCE vulnerabilities that compromise the managed infrastructure.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1210 Exploitation of Remote Services
- T1213 Data from Information Repositories
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1595 Active Scanning
- T1587 Develop Capabilities
- T1486 Data Encrypted for Impact
- T1059 Command and Scripting Interpreter
- T1559 Inter-Process Communication
- T1053 Scheduled Task/Job
- T1098 Account Manipulation
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1212 Exploitation for Credential Access
- T1110 Brute Force
- T1087 Account Discovery
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1095 Non-Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation
- T1583 Acquire Infrastructure
- T1136 Create Account
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1555 Credentials from Password Stores
- T1016 System Network Configuration Discovery
- T1069 Permission Groups Discovery
- T1074 Data Staged
- T1567 Exfiltration Over Web Service

## Free detection (Splunk SPL, Microsoft KQL)

**SolarWinds WHD Deserialization Exploit Detection** (`TL-2026-0060-DET-001`)

Detects suspicious Java deserialization patterns in Web Help Desk logs

- **Languages:** Splunk SPL, Microsoft KQL
- **Data sources:** solarwinds, application
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=solarwinds sourcetype="webhelpdesk:logs" 
| rex field=_raw "(?<suspicious_class>org\.apache\.commons\.collections\.|ysoserial\.|com\.sun\.org\.apache\.xalan)"
| where isnotnull(suspicious_class)
| stats count by host, suspicious_class, _time
| where count > 0
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceProduct has "SolarWinds" or ApplicationProtocol has "WHD"
| where Message has_any ("ysoserial", "CommonsCollections", "Jdk7u21", "Spring1", "URLDNS")
| project TimeGenerated, SourceIP, DestinationIP, Message
```

**Known false positives:**

- Legitimate use of Apache Commons Collections (rare in logs)

**Tuning notes:** None needed - these patterns indicate exploitation

### 29 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SolarWinds WHD CVE-2025-40551 — CSRF Bypass via badparam Parameter (locked: unlock with TL Creds)
- SolarWinds WHD JSONRPC Bridge Access via /wo/ Path Bypass (locked: unlock with TL Creds)
- SolarWinds WHD — JNDI Outbound Connection from Java Process (locked: unlock with TL Creds)
- SolarWinds WHD — Default Credentials Login Attempt (client/client) (locked: unlock with TL Creds)
- SolarWinds WHD — Deserialization Error in jabsorb JSONRPCBridge (locked: unlock with TL Creds)
- SolarWinds WHD — Known Attacker IP Access (locked: unlock with TL Creds)
- SolarWinds WHD CVE-2025-40551 — Full Exploit Chain Detection (locked: unlock with TL Creds)
- Java Process Spawning Shell — Potential JNDI RCE (locked: unlock with TL Creds)
- SolarWinds WHD — Whitelist Bypass Payload Detection (locked: unlock with TL Creds)
- SolarWinds WHD Unexpected Child Processes (locked: unlock with TL Creds)
- SolarWinds WHD Network Anomaly (locked: unlock with TL Creds)
- SolarWinds WHD Exploit Chain — Web Request Correlation (locked: unlock with TL Creds)
- Java Process JNDI Exploitation — Shell Spawning and Outbound LDAP (locked: unlock with TL Creds)
- SolarWinds WHD Default Credentials Usage and Privilege Escalation (locked: unlock with TL Creds)
- SolarWinds WHD CVE-2025-40551 — Exploitation Parameters in Web Requests (locked: unlock with TL Creds)
- SolarWinds WHD jabsorb Deserialization and Whitelist Bypass in Application Logs (locked: unlock with TL Creds)
- SolarWinds WHD Java Process Spawning Shell — JNDI RCE Indicator (locked: unlock with TL Creds)
- SolarWinds WHD CSRF Bypass and WebObject Component Creation (locked: unlock with TL Creds)
- SolarWinds WHD JSONRPC Deserialization via /wo/ Path Bypass (locked: unlock with TL Creds)
- SolarWinds WHD JNDI Outbound Connection and Known Attacker IPs (locked: unlock with TL Creds)
- SolarWinds WHD JSONRPC Bridge Error in Application Logs — Deserialization Exploitation (locked: unlock with TL Creds)
- SolarWinds WHD Hardcoded Credentials Login — CVE-2025-40537 client:client (locked: unlock with TL Creds)
- Connections from Known WHD Exploitation IPs — SolarWinds Advisory IOCs (locked: unlock with TL Creds)
- SolarWinds WHD Access Log Exploitation Indicators — [indicator]/badparam/wopage Patterns (locked: unlock with TL Creds)
- OAST/DNS Callback from SolarWinds WHD Server — JNDI Exploitation Confirmation (locked: unlock with TL Creds)
- SolarWinds WHD WebObjects Session Enumeration via Recording Header (locked: unlock with TL Creds)
- SolarWinds WHD Exploit Chain — wopage Parameter and [indicator] in Request URI (locked: unlock with TL Creds)
- SolarWinds WHD JSONRPC Deserialization Payload via /wo/ Path — CVE-2025-40551 (locked: unlock with TL Creds)
- Outbound LDAP Connection from SolarWinds WHD Server — JNDI Exploitation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 69)

Defanged, TLP:CLEAR.

- IP address: `178.128.210[.]172`
- IP address: `137.184.229[.]230`

Full set of 69 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Horizon3.ai: CVE-2025-40551 — Another SolarWinds WHD Deserialization Issue](https://horizon3.ai/attack-research/cve-2025-40551-another-solarwinds-web-help-desk-deserialization-issue/)
- [SolarWinds Trust Center: CVE-2025-40551 Advisory](https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40551)
- [SolarWinds WHD 2026.1 Release Notes](https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm)
- [CISA KEV: CVE-2025-40551](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40551)
- [NVD: CVE-2025-40551](https://nvd.nist.gov/vuln/detail/CVE-2025-40551)
- [CVE.org: CVE-2025-40551](https://www.cve.org/CVERecord?id=CVE-2025-40551)
- [SolarWinds Advisory: CVE-2024-28986 (original vuln)](https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28986)
- [SolarWinds Advisory: CVE-2024-28988 (first bypass)](https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28988)
- [SolarWinds Advisory: CVE-2025-26399 (second bypass)](https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399)
- [SolarWinds Advisory — CVE-2025-40551 WHD Deserialization RCE (CISA KEV)](https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40551)
- [SolarWinds Advisory — CVE-2025-40553 WHD Deserialization RCE (watchTowr)](https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40553)
- [SolarWinds Advisory — CVE-2025-40552 WHD Authentication Bypass](https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40552)
- [SolarWinds Advisory — CVE-2025-40536 WHD Security Control Bypass](https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40536)
- [NVD — CVE-2024-28986 WHD Java Deserialization (Original, CISA KEV)](https://nvd.nist.gov/vuln/detail/CVE-2024-28986)
- [SolarWinds Advisory — CVE-2024-28987 WHD Hardcoded Credentials](https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987)

## Full data

The other 29 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0060