CVE-2025-40536: Web Help Desk filter bypass that opens the way to unauthenticated RCE

What it is

CVE-2025-40536 is a security control bypass in SolarWinds Web Help Desk. Horizon3.ai, who found it, describes a request-filter bypass that lets an unauthenticated attacker reach restricted WebObjects components. On its own it grants access to restricted functionality. SolarWinds rates it high (CVSS 8.1).

Its value to an attacker is as a first step. Horizon3.ai chains it with CVE-2025-40551, an unsafe Java deserialization in AjaxProxy components, to get unauthenticated remote code execution. CVE-2025-40537, a static default client account created at initialization, may further simplify access to authenticated functions.

CISA lists this CVE in the KEV catalog (added 2026-02-12). Microsoft saw real intrusions on internet-facing Web Help Desk servers from December 2025, but said it could not confirm which CVE gave initial access. It named this one as a candidate, along with CVE-2025-40551 and CVE-2025-26399. SolarWinds’ advisory itself makes no exploitation statement.

Am I affected?

You’re affected if you run Web Help Desk 12.8.8 HF1 or any earlier version. Fixed in 2026.1.

SolarWinds’ advisory names no required configuration. Treat any server reachable from the internet as most at risk, and internal servers as exposed to anyone who can reach them.

To check your version, see the Web Help Desk version in the admin console or in the install folder. Huntress points to C:\Program Files\WebHelpDesk\version.txt on Windows.

Version 2026.1 also fixes CVE-2025-40537, CVE-2025-40551, CVE-2025-40552, CVE-2025-40553 and CVE-2025-40554, so upgrading closes the whole chain.

What to do

1. Upgrade to Web Help Desk 2026.1 or later. Download the packages from the SolarWinds Customer Portal, plan the upgrade path first, and install any available hotfixes after upgrading.
2. No workaround exists. SolarWinds lists none, and Horizon3.ai says there are no effective workarounds for vulnerable versions. Until you can upgrade, take the server off the internet or put it behind a VPN or firewall, as Huntress and Microsoft advise.
3. Change the default credentials. SolarWinds tells you to change the default admin password and to create a new client account linked to the admin account for production.
4. If the server was exposed while vulnerable, treat it as compromised. Horizon3.ai advises collecting logs, isolating the system and engaging incident response. Then:
   • Rebuild or restore the host from a known-good state. Upgrading doesn’t remove a foothold.
   • Reset passwords for service accounts, administrator accounts and any credentials stored in or reachable through Web Help Desk.
   • Look for lateral movement. Microsoft saw credential theft from LSASS and DCSync against a domain controller.

Detection

• Session logs: login events with eventType=[login] and username=[client] (the default account), per Horizon3.ai.
• Application logs: org.jabsorb.JSONRPCBridge exceptions, and JSONRPC or AjaxProxy errors or unexpected method calls.
• Access logs: requests to /Helpdesk.woa/wo/* with unusual query parameters, especially ones containing /ajax/.
• Child processes of the Web Help Desk Java process (under \WebHelpDesk\bin\), such as whoami, net user, nltest, bitsadmin or encoded PowerShell. Silent msiexec /q /i installs started by java.exe or wrapper.exe are another sign (Huntress).
• Unexpected remote access tools: Zoho Assist, ManageEngine RMM (ToolsIQ.exe), Velociraptor, Cloudflared and VS Code tunnels.
• Persistence: the TPMProfiler scheduled task, and qemu-system-x86_64.exe running from a user profile folder with a hostfwd SSH port forward.
• Credential theft: wab.exe loading a malicious sspicli.dll, LSASS access, and print.exe with /D: and \windows\ntds\ntds.dit in the command line.
• Defence tampering: registry changes that disable Defender real-time protection or the Windows Firewall service.