# SolarWinds Web Help Desk Pre-Auth RCE Chain (CVE-2025-40552, CVE-2025-40553, CVE-2025-40554)

> watchTowr Labs disclosed a three-bug pre-authentication RCE chain in SolarWinds Web Help Desk: a WebObjects page-restoration auth bypass (CVE-2025-40552), a Java deserialization RCE via commons-dbcp2 BasicDataSource abusing PostgreSQL's COPY FROM PROGRAM (CVE-2025-40553), and a secondary Ajax auth bypass (CVE-2025-40554). Chained together, an unauthenticated attacker executes OS commands as SYSTEM; a public Detection Artifact Generator PoC is on GitHub and sibling WHD deserialization bugs are already under active exploitation.

- **Published:** 2026-02-25T00:00:00Z
- **Last reviewed:** 2026-02-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1517
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-solarwinds-whd-pre-auth-chain-tl-2026-1517.webp?v=a5671d6e (Threadlinqs threat intel: CVE-2025-40552 SolarWinds Help Desk Flaw: Detection & IOCs (TL-2026-1517) — Critical severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-1517
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 20
- **CVEs:** CVE-2025-40552, CVE-2025-40553, CVE-2025-40554, CVE-2025-26399

## Description

SolarWinds Web Help Desk (WHD), an on-prem/embedded-PostgreSQL ITSM help-desk platform used by 300,000+ organizations, shipped three chainable pre-authentication vulnerabilities disclosed by watchTowr Labs (WT-2025-0099, WT-2025-0100, WT-2025-0101) and patched in WHD 2026.1 on January 28, 2026.

CVE-2025-40552 abuses an error-handling path in the Java WebObjects framework: supplying an invalid elementID causes handlePageRestorationErrorInContext() to read an attacker-controlled page name from the wopage parameter without validating the caller's position in the hierarchical component tree, letting an unauthenticated client directly instantiate normally-protected pages such as LookAndFeelPref.

CVE-2025-40553 is the RCE payload: once inside a protected context, the attacker reaches the legacy Jabsorb JSON-RPC deserializer (org.jabsorb.JSONBridge.call / JSONSerializer.unmarshall), which happily instantiates org.apache.commons.dbcp2.BasicDataSource from attacker JSON. Triggering the object's getConnection() getter opens a JDBC connection to WHD's embedded PostgreSQL instance (which runs as SYSTEM, trusts all local connections via pg_hba.conf, and grants the whd DB user superadmin rights). The attacker sets validationQuery to a stacked SQL statement that creates a table and runs COPY <table> FROM PROGRAM '<os command>', turning a SQL validation check into arbitrary OS command execution as SYSTEM. A prior SolarWinds fix for CVE-2025-26399 stripped dangerous field names using a Jackson-based sanitizer that does not decode \x hex escapes, but the Jabsorb deserializer (using org.json.JSONObject) does decode them — so encoding the class field as "javax43lass" (i.e. java\x43lass) slips the same gadget past the patched filter.

CVE-2025-40554 is a second, independent pre-auth path into the same Ajax/deserialization surface, providing a fallback route to the RCE primitive if the WebObjects bypass is blocked or patched in isolation.

The three CVEs were reported to SolarWinds starting August-October 2025; SolarWinds initially disputed the RCE gadget's validity before confirming an alternate working gadget. Patches shipped as part of a larger January 28, 2026 SolarWinds Web Help Desk advisory that also fixed CVE-2025-40551 (a separate unauthenticated deserialization RCE found by Horizon3.ai researcher Jimi Sebree), CVE-2025-40536 (access-control bypass) and CVE-2025-40537 (hardcoded credentials). CISA added CVE-2025-40551 to the Known Exploited Vulnerabilities catalog on 2026-02-03/04 citing active in-the-wild exploitation, and Microsoft published a February 6, 2026 intrusion analysis of unpatched WHD instances showing post-exploitation activity (DLL side-loading via wab.exe for LSASS credential theft, DCSync, scheduled-task persistence, ManageEngine RMM and QEMU abuse, reverse SSH/RDP access) consistent with attackers already weaponizing the WHD deserialization vulnerability class before the January patch. watchTowr Labs published a public Detection Artifact Generator (DAG) Python PoC and full technical writeup on 2026-02-25 covering CVE-2025-40552/40553, making the specific three-bug chain in this record trivial to reproduce.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1587.004 Exploits
- T1190 Exploit Public-Facing Application
- T1059.003 Windows Command Shell
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1133 External Remote Services
- T1068 Exploitation for Privilege Escalation
- T1140 Deobfuscate/Decode Files or Information
- T1574.001 DLL
- T1036 Masquerading
- T1003.001 LSASS Memory
- T1003.006 DCSync
- T1033 System Owner/User Discovery
- T1021.004 SSH
- T1021.001 Remote Desktop Protocol
- T1572 Protocol Tunneling
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1489 Service Stop

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**WHD Service Account Spawning Command Shell — COPY FROM PROGRAM RCE Confirmation (CVE-2025-40553)** (`TL-2026-1517-SPL-002`)

Detects cmd.exe or powershell.exe spawned as a child of the WHD Java/WebObjects process (javaw.exe/java.exe) or the embedded PostgreSQL13ServiceWHD service account, consistent with the CVE-2025-40553 gadget triggering PostgreSQL's COPY ... FROM PROGRAM to execute OS commands as SYSTEM — including the public DAG's 'whoami' RCE-confirmation command.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.001, T1059.003
- **Data sources:** sysmon, windows_security, edr_process_telemetry
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval parent_lc=lower(ParentImage), image_lc=lower(Image)
| where (like(parent_lc, "%javaw.exe") OR like(parent_lc, "%java.exe") OR like(parent_lc, "%postgresql13servicewhd.exe"))
  AND (like(image_lc, "%cmd.exe") OR like(image_lc, "%powershell.exe"))
| eval whoami_hit=if(match(CommandLine, "(?i)whoami"), 1, 0)
| table _time, host, ParentImage, Image, CommandLine, whoami_hit, User
| sort -_time
```

### Microsoft KQL

```kql
let lookback = 24h;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName in~ ("javaw.exe", "java.exe", "PostgreSQL13ServiceWHD.exe")
| where FileName in~ ("cmd.exe", "powershell.exe")
| extend WhoamiConfirm = ProcessCommandLine has "whoami"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, WhoamiConfirm, AccountName
| order by Timestamp desc
```

### Sigma

```yaml
title: SolarWinds WHD Deserialization RCE - Child Process from WebObjects/PostgreSQL Service
id: 8f1a1c2e-40aa-4a2e-9c6e-whd-40553-001
status: experimental
description: Detects a suspicious child process (cmd.exe, powershell.exe) spawned by the SolarWinds Web Help Desk Java/WebObjects or PostgreSQL service account, consistent with the CVE-2025-40553 COPY FROM PROGRAM deserialization gadget executing OS commands as SYSTEM.
references:
    - https://labs.watchtowr.com/buy-a-help-desk-bundle-a-remote-access-solution-solarwinds-web-help-desk-pre-auth-rce-chain-s/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-19
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1059.001
    - attack.t1059.003
    - cve.2025.40553
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith:
            - '\javaw.exe'
            - '\java.exe'
            - '\PostgreSQL13ServiceWHD.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
    filter_confirm_cmd:
        CommandLine|contains: 'whoami'
    condition: selection_parent and (selection_child or filter_confirm_cmd)
falsepositives:
    - Legitimate WHD administrative scripting (rare)
level: high
```

**Known false positives:**

- Legitimate WHD administrative scripting or scheduled maintenance tasks invoking shell utilities (rare — verify against change tickets)

**Tuning notes:** Baseline known legitimate WHD maintenance scripts that spawn cmd.exe/powershell.exe from the Java service account and exclude their exact CommandLine hashes; keep the 'whoami' filter as a high-confidence sub-signal even if the parent/child pairing alone is noisy in some environments.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- WHD Ajax Endpoint Pre-Auth Bypass Probing (CVE-2025-40554) (locked: unlock with TL Creds)
- [indicator] DLL Side-Loading of [indicator] from Non-Standard Path (LSASS Credential Theft Precursor) (locked: unlock with TL Creds)
- DCSync Directory Replication Request from Non-Domain-Controller WHD Host (locked: unlock with TL Creds)
- SolarWinds WHD - PostgreSQL COPY FROM PROGRAM OS Command Execution (CVE-2025-40553) (locked: unlock with TL Creds)
- SolarWinds WHD - Suspicious Scheduled Task 'TPMProfiler' Persistence (locked: unlock with TL Creds)
- QEMU or ManageEngine RMM Execution on WHD Application Host (Unusual Binary Abuse) (locked: unlock with TL Creds)
- SolarWinds WHD Pre-Auth Deserialization Request — Hex-Escape Field Bypass (CVE-2025-40552/40553) (locked: unlock with TL Creds)
- Reverse SSH/RDP and Remote-Access-Software Egress from WHD Host (C2/Lateral Movement) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s))](https://labs.watchtowr.com/buy-a-help-desk-bundle-a-remote-access-solution-solarwinds-web-help-desk-pre-auth-rce-chain-s/)
- [watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553 (Detection Artifact Generator)](https://github.com/watchtowrlabs/watchTowr-vs-SolarWinds-WebHelpDesk-CVE-2025-40552-CVE-2025-40553)
- [ZDI-25-906 SolarWinds Web Help Desk Deserialization RCE (CVE-2025-26399)](https://www.zerodayinitiative.com/advisories/ZDI-25-906/)
- [SolarWinds Security Advisory - CVE-2025-40552](https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40552)
- [SolarWinds Security Advisory - CVE-2025-40553](https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40553)
- [SolarWinds Security Advisory - CVE-2025-40554](https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40554)
- [SolarWinds Web Help Desk 2026.1 Release Notes](https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm)
- [Multiple Critical SolarWinds Web Help Desk Vulnerabilities: CVE-2025-40551, CVE-2025-40552, CVE-2025-40553, CVE-2025-40554](https://www.rapid7.com/blog/post/etr-multiple-critical-solarwinds-web-help-desk-vulnerabilities-cve-2025-40551-40552-40553-40554/)
- [SolarWinds warns of critical Web Help Desk RCE, auth bypass flaws](https://www.bleepingcomputer.com/news/security/solarwinds-warns-of-critical-web-help-desk-rce-auth-bypass-flaws/)
- [SolarWinds Fixes Four Critical Web Help Desk Flaws With Unauthenticated RCE and Auth Bypass](https://thehackernews.com/2026/01/solarwinds-fixes-four-critical-web-help.html)
- [CISA Adds Actively Exploited SolarWinds Web Help Desk RCE to KEV Catalog](https://thehackernews.com/2026/02/cisa-adds-actively-exploited-solarwinds.html)
- [Analysis of active exploitation of SolarWinds Web Help Desk](https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/)
- [Active Exploitation of SolarWinds Web Help Desk (CVE-2025-26399)](https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399)
- [CAL-CSIC Cyber Advisory: Multiple Vulnerabilities in SolarWinds Web Help Desk](https://www.caloes.ca.gov/wp-content/uploads/Cal-CSIC-Cyber-Advisory-Multiple-Vulnerabilities-in-SolarWinds-Web-Help-Desk-1.pdf)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1517