SolarWinds Web Help Desk Pre-Auth RCE Chain (CVE-2025-40552, CVE-2025-40553, CVE-2025-40554)

SolarWinds Web Help Desk Pre-Auth RCE Chain (CVE-2025-40552 (TL-2026-1517), also tracked as WT-2025-0099, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-02-25. It has no confirmed attribution, affects SolarWinds Web Help Desk, references 3 CVEs (CVE-2025-40552, CVE-2025-40553, CVE-2025-40554), maps to 20 MITRE ATT&CK techniques (T1003.001, T1003.006, T1021.001), and is covered by 9 detection rules and 20 indicators of compromise.

Key facts for TL-2026-1517

Threat ID
TL-2026-1517
Also known as
WT-2025-0099, WT-2025-0100, WT-2025-0101, Buy A Help Desk, Bundle A Remote Access Solution
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-02-25
Last reviewed
2026-02-25
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, health, education, corporateit, managedserviceproviders
Target regions
Global
Detection rules
9
Indicators of compromise
20

Malware and tooling in SolarWinds Web Help Desk Pre-Auth RCE Chain (CVE-2025-40552

Malware and tooling: BITSAdmin/BITS, ManageEngine RMM, QEMU

watchTowr Labs disclosed a three-bug pre-authentication RCE chain in SolarWinds Web Help Desk: a WebObjects page-restoration auth bypass (CVE-2025-40552), a Java deserialization RCE via commons-dbcp2 BasicDataSource abusing PostgreSQL's COPY FROM PROGRAM (CVE-2025-40553), and a secondary Ajax auth bypass (CVE-2025-40554). Chained together, an unauthenticated attacker executes OS commands as SYSTEM; a public Detection Artifact Generator PoC is on GitHub and sibling WHD deserialization bugs are already under active exploitation.

How SolarWinds Web Help Desk Pre-Auth RCE Chain (CVE-2025-40552 works

SolarWinds Web Help Desk (WHD), an on-prem/embedded-PostgreSQL ITSM help-desk platform used by 300,000+ organizations, shipped three chainable pre-authentication vulnerabilities disclosed by watchTowr Labs (WT-2025-0099, WT-2025-0100, WT-2025-0101) and patched in WHD 2026.1 on January 28, 2026.

CVE-2025-40552 abuses an error-handling path in the Java WebObjects framework: supplying an invalid elementID causes handlePageRestorationErrorInContext() to read an attacker-controlled page name from the wopage parameter without validating the caller's position in the hierarchical component tree, letting an unauthenticated client directly instantiate normally-protected pages such as LookAndFeelPref.

CVE-2025-40553 is the RCE payload: once inside a protected context, the attacker reaches the legacy Jabsorb JSON-RPC deserializer (org.jabsorb.JSONBridge.call / JSONSerializer.unmarshall), which happily instantiates org.apache.commons.dbcp2.BasicDataSource from attacker JSON. Triggering the object's getConnection() getter opens a JDBC connection to WHD's embedded PostgreSQL instance (which runs as SYSTEM, trusts all local connections via pg_hba.conf, and grants the whd DB user superadmin rights). The attacker sets validationQuery to a stacked SQL statement that creates a table and runs COPY <table> FROM PROGRAM '<os command>', turning a SQL validation check into arbitrary OS command execution as SYSTEM. A prior SolarWinds fix for CVE-2025-26399 stripped dangerous field names using a Jackson-based sanitizer that does not decode \x hex escapes, but the Jabsorb deserializer (using org.json.JSONObject) does decode them — so encoding the class field as "javax43lass" (i.e. java\x43lass) slips the same gadget past the patched filter.

CVE-2025-40554 is a second, independent pre-auth path into the same Ajax/deserialization surface, providing a fallback route to the RCE primitive if the WebObjects bypass is blocked or patched in isolation.

The three CVEs were reported to SolarWinds starting August-October 2025; SolarWinds initially disputed the RCE gadget's validity before confirming an alternate working gadget. Patches shipped as part of a larger January 28, 2026 SolarWinds Web Help Desk advisory that also fixed CVE-2025-40551 (a separate unauthenticated deserialization RCE found by Horizon3.ai researcher Jimi Sebree), CVE-2025-40536 (access-control bypass) and CVE-2025-40537 (hardcoded credentials). CISA added CVE-2025-40551 to the Known Exploited Vulnerabilities catalog on 2026-02-03/04 citing active in-the-wild exploitation, and Microsoft published a February 6, 2026 intrusion analysis of unpatched WHD instances showing post-exploitation activity (DLL side-loading via wab.exe for LSASS credential theft, DCSync, scheduled-task persistence, ManageEngine RMM and QEMU abuse, reverse SSH/RDP access) consistent with attackers already weaponizing the WHD deserialization vulnerability class before the January patch. watchTowr Labs published a public Detection Artifact Generator (DAG) Python PoC and full technical writeup on 2026-02-25 covering CVE-2025-40552/40553, making the specific three-bug chain in this record trivial to reproduce.

MITRE ATT&CK techniques used in TL-2026-1517

Credential Access

T1003.001 LSASS Memory; T1003.006 DCSync

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.004 SSH

Discovery

T1033 System Owner/User Discovery

Defense Evasion

T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information

Persistence

T1053.005 Scheduled Task; T1133 External Remote Services

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1572 Protocol Tunneling

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1489 Service Stop

stealth

T1574.001 DLL

Resource Development

T1587.004 Exploits

Reconnaissance

T1595.002 Vulnerability Scanning

Affected products and versions in SolarWinds Web Help Desk Pre-Auth RCE Chain (CVE-2025-40552

  • SolarWinds — Web Help Desk
    Vulnerable versions: 12.8.8 Hotfix 1 and below
    Fixed in: 2026.1 and later

Remediation for SolarWinds Web Help Desk Pre-Auth RCE Chain (CVE-2025-40552

Patches

  • SolarWinds Web Help Desk 2026.1 (release notes: documentation.solarwinds.com WHD 2026.1)

Immediate actions

  • Upgrade SolarWinds Web Help Desk to version 2026.1 or later, which fixes CVE-2025-40552, CVE-2025-40553, CVE-2025-40554 plus sibling CVE-2025-40551/40536/40537
  • Remove direct internet exposure of the WHD web interface; place it behind VPN/zero-trust access only
  • Restrict network access to the embedded PostgreSQL instance and audit pg_hba.conf for trust-based local auth
  • Hunt for the watchTowr DAG's SWWHDDAG-prefixed table artifacts in the WHD postgres database as evidence of prior scanning/exploitation attempts

Workarounds

  • If patching is not immediately possible, disable public/internet access to the WHD WebObjects and Ajax endpoints (/helpdesk/WebObjects/Helpdesk.woa/*) at the perimeter
  • Disable or firewall the embedded PostgreSQL listener from all but localhost application access

Longer-term hardening

  • Deploy EDR/behavioral detection on WHD application servers for anomalous child processes spawned by the Java/WebObjects service account
  • Monitor for wab.exe spawning unexpected DLLs (e.g. sspicli.dll) consistent with side-loading for LSASS credential theft
  • Alert on DCSync-pattern directory replication requests from non-domain-controller hosts
  • Restrict or monitor outbound use of legitimate RMM tooling (e.g. ManageEngine) and BITS transfers from help-desk infrastructure

CVEs associated with SolarWinds Web Help Desk Pre-Auth RCE Chain (CVE-2025-40552

CVE-2025-40552, CVE-2025-40553, CVE-2025-40554

Weaknesses (CWE) in SolarWinds Web Help Desk Pre-Auth RCE Chain (CVE-2025-40552

CWE-502, CWE-1390

Timeline of SolarWinds Web Help Desk Pre-Auth RCE Chain (CVE-2025-40552

  • Prior WHD deserialization RCE (CVE-2025-26399 / ZDI-25-906) reported to SolarWinds by an anonymous researcher via Zero Day Initiative, establishing the deserialization gadget family later reused in this chain.
  • ZDI-25-906 public advisory released for CVE-2025-26399; SolarWinds' subsequent patch (Jackson-based field sanitizer) becomes the control that CVE-2025-40553 later bypasses.
  • watchTowr Labs discovers and reports CVE-2025-40552 (WebObjects auth bypass, WT-2025-0099) and CVE-2025-40553 (commons-dbcp2/PostgreSQL deserialization RCE, WT-2025-0100) to SolarWinds.
  • SolarWinds confirms it can reproduce the reported issues but initially disputes the validity/impact of the WT-2025-0100 RCE gadget.
  • watchTowr Labs submits an alternative, working RCE gadget for CVE-2025-40553 after the vendor's initial dispute.
  • watchTowr Labs discovers and reports CVE-2025-40554 (secondary Ajax pre-auth bypass, WT-2025-0101) as an alternative route into the same deserialization surface.
  • SolarWinds confirms CVE-2025-40553 is exploitable using watchTowr's revised gadget.
  • Microsoft telemetry later attributes intrusion activity in this window to exploitation of unpatched WHD deserialization vulnerabilities (CVE-2025-40551/CVE-2025-40536/CVE-2025-26399 family), including DLL side-loading, DCSync, and reverse SSH/RDP persistence on compromised WHD hosts.
  • SolarWinds ships Web Help Desk 2026.1, fixing CVE-2025-40551, CVE-2025-40552, CVE-2025-40553, CVE-2025-40554, CVE-2025-40536 and CVE-2025-40537; all six CVEs are publicly assigned/disclosed.
  • CISA adds CVE-2025-40551 to the Known Exploited Vulnerabilities catalog citing active exploitation, with FCEB remediation deadlines of 2026-02-06 (CVE-2025-40551) and 2026-02-24 (remaining CVEs) under BOD 22-01.
  • Microsoft Security publishes a detailed intrusion analysis of active exploitation against unpatched SolarWinds Web Help Desk instances, describing post-exploitation tradecraft (LSASS credential theft via wab.exe/sspicli.dll side-loading, DCSync, ManageEngine RMM and QEMU abuse, scheduled task 'TPMProfiler', reverse SSH/RDP access).
  • watchTowr Labs publishes the full technical writeup for CVE-2025-40552/CVE-2025-40553/CVE-2025-40554 plus a public Python Detection Artifact Generator PoC on GitHub, making the specific three-bug chain trivially reproducible.

Sources cited for SolarWinds Web Help Desk Pre-Auth RCE Chain (CVE-2025-40552

Threats related to SolarWinds Web Help Desk Pre-Auth RCE Chain (CVE-2025-40552

Detection coverage for TL-2026-1517

As of 2026-02-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1517 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats