SolarWinds Web Help Desk Pre-Auth RCE Chain (CVE-2025-40552, CVE-2025-40553, CVE-2025-40554)

Key facts for SolarWinds WHD pre-auth chain

Detection coverage for SolarWinds WHD pre-auth chain

As of 2026-02-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1517 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: WHD Service Account Spawning Command Shell — COPY FROM PROGRAM RCE Confirmation (CVE-2025-40553)

Detects cmd.exe or powershell.exe spawned as a child of the WHD Java/WebObjects process (javaw.exe/java.exe) or the embedded PostgreSQL13ServiceWHD service account, consistent with the CVE-2025-40553 gadget triggering PostgreSQL's COPY ... FROM PROGRAM to execute OS commands as SYSTEM — including the public DAG's 'whoami' RCE-confirmation command.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059.001, T1059.003
• Data sources: sysmon, windows_security, edr_process_telemetry
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent_lc=lower(ParentImage), image_lc=lower(Image)
| where (like(parent_lc, "%javaw.exe") OR like(parent_lc, "%java.exe") OR like(parent_lc, "%postgresql13servicewhd.exe"))
  AND (like(image_lc, "%cmd.exe") OR like(image_lc, "%powershell.exe"))
| eval whoami_hit=if(match(CommandLine, "(?i)whoami"), 1, 0)
| table _time, host, ParentImage, Image, CommandLine, whoami_hit, User
| sort -_time

Microsoft KQL

let lookback = 24h;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName in~ ("javaw.exe", "java.exe", "PostgreSQL13ServiceWHD.exe")
| where FileName in~ ("cmd.exe", "powershell.exe")
| extend WhoamiConfirm = ProcessCommandLine has "whoami"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, WhoamiConfirm, AccountName
| order by Timestamp desc

Sigma

title: SolarWinds WHD Deserialization RCE - Child Process from WebObjects/PostgreSQL Service
id: 8f1a1c2e-40aa-4a2e-9c6e-whd-40553-001
status: experimental
description: Detects a suspicious child process (cmd.exe, powershell.exe) spawned by the SolarWinds Web Help Desk Java/WebObjects or PostgreSQL service account, consistent with the CVE-2025-40553 COPY FROM PROGRAM deserialization gadget executing OS commands as SYSTEM.
references:
    - https://labs.watchtowr.com/buy-a-help-desk-bundle-a-remote-access-solution-solarwinds-web-help-desk-pre-auth-rce-chain-s/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-19
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
    - cve.2025.40553
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith:
            - '\javaw.exe'
            - '\java.exe'
            - '\PostgreSQL13ServiceWHD.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
    filter_confirm_cmd:
        CommandLine|contains: 'whoami'
    condition: selection_parent and (selection_child or filter_confirm_cmd)
falsepositives:
    - Legitimate WHD administrative scripting (rare)
level: high

Known false positives:

• Legitimate WHD administrative scripting or scheduled maintenance tasks invoking shell utilities (rare — verify against change tickets)

Tuning notes: Baseline known legitimate WHD maintenance scripts that spawn cmd.exe/powershell.exe from the Java service account and exclude their exact CommandLine hashes; keep the 'whoami' filter as a high-confidence sub-signal even if the parent/child pairing alone is noisy in some environments.

• 🔒 WHD Ajax Endpoint Pre-Auth Bypass Probing (CVE-2025-40554) · unlock with TL Creds
• 🔒 [indicator] DLL Side-Loading of [indicator] from Non-Standard Path (LSASS Credential Theft Precursor) · unlock with TL Creds
• 🔒 DCSync Directory Replication Request from Non-Domain-Controller WHD Host · unlock with TL Creds
• 🔒 SolarWinds WHD - PostgreSQL COPY FROM PROGRAM OS Command Execution (CVE-2025-40553) · unlock with TL Creds
• 🔒 SolarWinds WHD - Suspicious Scheduled Task 'TPMProfiler' Persistence · unlock with TL Creds
• 🔒 QEMU or ManageEngine RMM Execution on WHD Application Host (Unusual Binary Abuse) · unlock with TL Creds
• 🔒 SolarWinds WHD Pre-Auth Deserialization Request — Hex-Escape Field Bypass (CVE-2025-40552/40553) · unlock with TL Creds
• 🔒 Reverse SSH/RDP and Remote-Access-Software Egress from WHD Host (C2/Lateral Movement) · unlock with TL Creds

Indicators of compromise for SolarWinds WHD pre-auth chain

As of 2026-02-25, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-1517.

How SolarWinds WHD pre-auth chain works

SolarWinds Web Help Desk (WHD), an on-prem/embedded-PostgreSQL ITSM help-desk platform used by 300,000+ organizations, shipped three chainable pre-authentication vulnerabilities disclosed by watchTowr Labs (WT-2025-0099, WT-2025-0100, WT-2025-0101) and patched in WHD 2026.1 on January 28, 2026.

CVE-2025-40552 abuses an error-handling path in the Java WebObjects framework: supplying an invalid elementID causes handlePageRestorationErrorInContext() to read an attacker-controlled page name from the wopage parameter without validating the caller's position in the hierarchical component tree, letting an unauthenticated client directly instantiate normally-protected pages such as LookAndFeelPref.

CVE-2025-40553 is the RCE payload: once inside a protected context, the attacker reaches the legacy Jabsorb JSON-RPC deserializer (org.jabsorb.JSONBridge.call / JSONSerializer.unmarshall), which happily instantiates org.apache.commons.dbcp2.BasicDataSource from attacker JSON. Triggering the object's getConnection() getter opens a JDBC connection to WHD's embedded PostgreSQL instance (which runs as SYSTEM, trusts all local connections via pg_hba.conf, and grants the whd DB user superadmin rights). The attacker sets validationQuery to a stacked SQL statement that creates a table and runs COPY <table> FROM PROGRAM '<os command>', turning a SQL validation check into arbitrary OS command execution as SYSTEM. A prior SolarWinds fix for CVE-2025-26399 stripped dangerous field names using a Jackson-based sanitizer that does not decode \x hex escapes, but the Jabsorb deserializer (using org.json.JSONObject) does decode them — so encoding the class field as "javax43lass" (i.e. java\x43lass) slips the same gadget past the patched filter.

CVE-2025-40554 is a second, independent pre-auth path into the same Ajax/deserialization surface, providing a fallback route to the RCE primitive if the WebObjects bypass is blocked or patched in isolation.

The three CVEs were reported to SolarWinds starting August-October 2025; SolarWinds initially disputed the RCE gadget's validity before confirming an alternate working gadget. Patches shipped as part of a larger January 28, 2026 SolarWinds Web Help Desk advisory that also fixed CVE-2025-40551 (a separate unauthenticated deserialization RCE found by Horizon3.ai researcher Jimi Sebree), CVE-2025-40536 (access-control bypass) and CVE-2025-40537 (hardcoded credentials). CISA added CVE-2025-40551 to the Known Exploited Vulnerabilities catalog on 2026-02-03/04 citing active in-the-wild exploitation, and Microsoft published a February 6, 2026 intrusion analysis of unpatched WHD instances showing post-exploitation activity (DLL side-loading via wab.exe for LSASS credential theft, DCSync, scheduled-task persistence, ManageEngine RMM and QEMU abuse, reverse SSH/RDP access) consistent with attackers already weaponizing the WHD deserialization vulnerability class before the January patch. watchTowr Labs published a public Detection Artifact Generator (DAG) Python PoC and full technical writeup on 2026-02-25 covering CVE-2025-40552/40553, making the specific three-bug chain in this record trivial to reproduce.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 LSASS Memory; T1003.006 DCSync

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.004 SSH

Discovery

T1033 System Owner/User Discovery

Defense Evasion

T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information

Persistence

T1053.005 Scheduled Task; T1133 External Remote Services

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1572 Protocol Tunneling

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1489 Service Stop

stealth

T1574.001 DLL

Resource Development

T1587.004 Exploits

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation for SolarWinds WHD pre-auth chain

Patches

• SolarWinds Web Help Desk 2026.1 (release notes: documentation.solarwinds.com WHD 2026.1)

Immediate actions

• Upgrade SolarWinds Web Help Desk to version 2026.1 or later, which fixes CVE-2025-40552, CVE-2025-40553, CVE-2025-40554 plus sibling CVE-2025-40551/40536/40537
• Remove direct internet exposure of the WHD web interface; place it behind VPN/zero-trust access only
• Restrict network access to the embedded PostgreSQL instance and audit pg_hba.conf for trust-based local auth
• Hunt for the watchTowr DAG's SWWHDDAG-prefixed table artifacts in the WHD postgres database as evidence of prior scanning/exploitation attempts

Workarounds

• If patching is not immediately possible, disable public/internet access to the WHD WebObjects and Ajax endpoints (/helpdesk/WebObjects/Helpdesk.woa/*) at the perimeter
• Disable or firewall the embedded PostgreSQL listener from all but localhost application access

Longer-term hardening

• Deploy EDR/behavioral detection on WHD application servers for anomalous child processes spawned by the Java/WebObjects service account
• Monitor for wab.exe spawning unexpected DLLs (e.g. sspicli.dll) consistent with side-loading for LSASS credential theft
• Alert on DCSync-pattern directory replication requests from non-domain-controller hosts
• Restrict or monitor outbound use of legitimate RMM tooling (e.g. ManageEngine) and BITS transfers from help-desk infrastructure

Affected and fixed versions

• SolarWinds — Web Help Desk
  Vulnerable versions: 12.8.8 Hotfix 1 and below
  Fixed in: 2026.1 and later

Timeline of SolarWinds WHD pre-auth chain

• 2025-08-26 Prior WHD deserialization RCE (CVE-2025-26399 / ZDI-25-906) reported to SolarWinds by an anonymous researcher via Zero Day Initiative, establishing the deserialization gadget family later reused in this chain.
• 2025-09-23 ZDI-25-906 public advisory released for CVE-2025-26399; SolarWinds' subsequent patch (Jackson-based field sanitizer) becomes the control that CVE-2025-40553 later bypasses.
• 2025-09-29 watchTowr Labs discovers and reports CVE-2025-40552 (WebObjects auth bypass, WT-2025-0099) and CVE-2025-40553 (commons-dbcp2/PostgreSQL deserialization RCE, WT-2025-0100) to SolarWinds.
• 2025-10-01 SolarWinds confirms it can reproduce the reported issues but initially disputes the validity/impact of the WT-2025-0100 RCE gadget.
• 2025-10-03 watchTowr Labs submits an alternative, working RCE gadget for CVE-2025-40553 after the vendor's initial dispute.
• 2025-10-06 watchTowr Labs discovers and reports CVE-2025-40554 (secondary Ajax pre-auth bypass, WT-2025-0101) as an alternative route into the same deserialization surface.
• 2025-10-17 SolarWinds confirms CVE-2025-40553 is exploitable using watchTowr's revised gadget.
• 2025-12-01 Microsoft telemetry later attributes intrusion activity in this window to exploitation of unpatched WHD deserialization vulnerabilities (CVE-2025-40551/CVE-2025-40536/CVE-2025-26399 family), including DLL side-loading, DCSync, and reverse SSH/RDP persistence on compromised WHD hosts.
• 2026-01-28 SolarWinds ships Web Help Desk 2026.1, fixing CVE-2025-40551, CVE-2025-40552, CVE-2025-40553, CVE-2025-40554, CVE-2025-40536 and CVE-2025-40537; all six CVEs are publicly assigned/disclosed.
• 2026-02-03 CISA adds CVE-2025-40551 to the Known Exploited Vulnerabilities catalog citing active exploitation, with FCEB remediation deadlines of 2026-02-06 (CVE-2025-40551) and 2026-02-24 (remaining CVEs) under BOD 22-01.
• 2026-02-06 Microsoft Security publishes a detailed intrusion analysis of active exploitation against unpatched SolarWinds Web Help Desk instances, describing post-exploitation tradecraft (LSASS credential theft via locked-ioc-17/locked-ioc-15 side-loading, DCSync, locked-ioc-13 and locked-ioc-18 abuse, scheduled task 'TPMProfiler', reverse SSH/RDP access).
• 2026-02-25 watchTowr Labs publishes the full technical writeup for CVE-2025-40552/CVE-2025-40553/CVE-2025-40554 plus a public Python Detection Artifact Generator PoC on GitHub, making the specific three-bug chain trivially reproducible.

Sources cited for SolarWinds WHD pre-auth chain

• ZDI-25-906 SolarWinds Web Help Desk Deserialization RCE (CVE-2025-26399) zerodayinitiative.com · Advisory · 2025-09-23
• CAL-CSIC Cyber Advisory: Multiple Vulnerabilities in SolarWinds Web Help Desk caloes.ca.gov · Advisory · 2026-01-29
• Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s)) labs.watchtowr.com · Research · 2026-02-25
• SolarWinds Security Advisory - CVE-2025-40552 solarwinds.com · Vendor report · 2026-01-28
• SolarWinds Security Advisory - CVE-2025-40553 solarwinds.com · Vendor report · 2026-01-28
• SolarWinds Security Advisory - CVE-2025-40554 solarwinds.com · Vendor report · 2026-01-28
• SolarWinds Web Help Desk 2026.1 Release Notes documentation.solarwinds.com · Vendor report · 2026-01-28
• Multiple Critical SolarWinds Web Help Desk Vulnerabilities: CVE-2025-40551, CVE-2025-40552, CVE-2025-40553, CVE-2025-40554 Rapid7 · Research · 2026-01-28
• watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553 (Detection Artifact Generator) GitHub · Proof of concept · 2026-02-25
• Analysis of active exploitation of SolarWinds Web Help Desk Microsoft · Blog · 2026-02-06
• Active Exploitation of SolarWinds Web Help Desk (CVE-2025-26399) Huntress · Blog · 2025-09-25
• SolarWinds warns of critical Web Help Desk RCE, auth bypass flaws BleepingComputer · News · 2026-01-28
• SolarWinds Fixes Four Critical Web Help Desk Flaws With Unauthenticated RCE and Auth Bypass The Hacker News · News · 2026-01-28
• CISA Adds Actively Exploited SolarWinds Web Help Desk RCE to KEV Catalog The Hacker News · News · 2026-02-04

Threats related to SolarWinds WHD pre-auth chain

• CVE-2026-28323: SolarWinds Web Help Desk SAML Authentication Bypass