CVE-2025-40551: Web Help Desk unauthenticated RCE via deserialization, exploited

What it is

Web Help Desk (WHD) is SolarWinds’ IT help desk server. Its AjaxProxy component uses the jabsorb JSON-RPC library to call component methods, and it deserializes untrusted data. An unauthenticated attacker can run commands on the server, CVSS 9.8.

Horizon3.ai, which found the bug, says it is a bypass of earlier fixes for CVE-2024-28986 and CVE-2024-28988. A CSRF filter checks query parameters against a whitelist, but an extra crafted parameter skips the check. A sanitizer and a payload blacklist were also bypassable. SolarWinds fixed it together with five other WHD CVEs in 2026.1, including a second deserialization RCE (CVE-2025-40553) and two authentication bypasses (CVE-2025-40552, CVE-2025-40554). Patch them all in one step.

CISA added it to KEV on 2026-02-03. Microsoft and Huntress saw WHD servers used as an entry point to a domain: remote management tools, a hidden QEMU virtual machine for SSH access, credential theft and DCSync. Neither could say which CVE was used for initial access, because those servers were exposed to several.

Am I affected?

You’re affected if you run Web Help Desk 12.8.8 HF1 or earlier. The fix is 2026.1.

The risk is highest when the WHD web interface is reachable from the internet. Microsoft’s attacks were on internet-exposed servers. Internal-only servers are still reachable by anyone already inside your network.

SolarWinds’ advisory does not name a required configuration or a workaround. Rapid7 notes that WHD was already on KEV twice before.

Horizon3.ai also flags a related issue (CVE-2025-40537): a default client account may be left active in some deployments. Check whether it exists and is disabled.

What to do

1. Upgrade to Web Help Desk 2026.1 or later. Work out your upgrade path with SolarWinds’ Upgrade WHD guide and download the package from the Customer Portal. The release notes say to install any 2026.1 hotfixes after upgrading. Windows Server 2019 and 2022 are the supported production platforms.
2. Take WHD off the internet until it’s patched, and keep admin paths reachable only over VPN or a firewall rule (Microsoft and Huntress both advise this).
3. Increase logging on the Ajax Proxy (Microsoft’s advice) so you can see attempts.
4. Disable the default client account if it exists (Horizon3.ai).
5. If the server was exposed and unpatched, treat it as compromised. Check it (below). If you find signs of compromise:
   • Isolate the host, and rebuild it rather than clean it.
   • Remove remote tools you didn’t install, such as ManageEngine/Zoho RMM, Velociraptor, Cloudflared and VS Code tunnels.
   • Rotate credentials, starting with service and admin accounts reachable from WHD and any credentials stored in WHD.
   • Hunt for lateral movement and DCSync activity from the WHD host.

Detection

SolarWinds lists these in its advisory:

• Application logs (\WebHelpDesk\log\whd_yyyy-mm-dd.txt): calls to an OAST server.
• Access logs (\WebHelpDesk\logs\whd_access_log_yyyy-mm-dd.txt): requests containing bogus or badparam=/ajax/….
• Traffic from 178.128.210[.]172 and 137.184.229[.]230.

Horizon3.ai adds:

• A log line ERROR org.jabsorb.JSONRPCBridge - exception occured.
• A log line Whitelisted payload with matched keyword: java...
• A session log entry eventType=[login], accountType=[client], username=[client].
• Requests to /Helpdesk.woa/wo/* with parameters outside the application’s normal set, and any parameter containing /ajax/.

Microsoft and Huntress describe what happened after exploitation:

• wrapper.exe or java.exe (the WHD service) spawning cmd.exe, msiexec or PowerShell, including BITS downloads and msiexec /q /i from a remote URL.
• A scheduled task named TPMProfiler and a qemu-system-x86_64.exe process or binary in a user directory, with port 22022 forwarded to SSH.
• ToolsIQ.exe or other RMM, Velociraptor or Cloudflared installs that IT didn’t deploy.
• wab.exe loading a sspicli.dll from outside System32, and LSASS access.
• Registry changes that disable Windows Defender or the firewall (mpssvc).
• net group "domain computers" /do and domain admin enumeration.