SolarWinds Web Help Desk allows unauthenticated remote code execution
SolarWinds Web Help Desk has multiple critical vulnerabilities including unauthenticated RCE via deserialization, allowing SYSTEM-level code execution.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 6 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2025-40536 and CVE-2025-40551 as exploited in the wild.
Multiple critical vulnerabilities have been discovered in SolarWinds Web Help Desk versions prior to 2026.1. The most severe flaws include unauthenticated remote code execution via deserialization (CVE-2025-40551, CVE-2025-40553), multiple authentication bypass vulnerabilities (CVE-2025-40552, CVE-2025-40554), security control bypass (CVE-2025-40536), and hardcoded credentials (CVE-2025-40537). Successful exploitation could allow an unauthenticated attacker to execute arbitrary code with SYSTEM privileges, enabling full system compromise including program installation, data manipulation, and account creation.
The vulnerabilities affect SolarWinds Web Help Desk, a web-based IT service management platform used for help desk ticketing and asset management. The combination of unauthenticated access and code execution capabilities presents a severe risk to organizations running vulnerable versions. MS-ISAC has issued this advisory with immediate patching recommendations, though there are currently no reports of active exploitation in the wild.
Organizations are strongly advised to apply updates to version 2026.1 immediately after testing. Additional mitigations include implementing network segmentation, applying least privilege principles, conducting vulnerability scans, and reviewing service account inventories to limit exposure of internet-facing instances.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by SolarWinds Web Help Desk Java Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell or scripting interpreter spawned by the Java process running SolarWinds Web Help Desk, indicative of exploitation of an unauthenticated deserialization or RCE vulnerability (CVE-2025-40551/40553). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Spawned from SolarWinds Web Help Desk Java Process
id: 52ed0809-bbce-5580-b751-03acace875df
status: experimental
description: 'Detects command interpreters (cmd.exe, powershell.exe, sh, bash) spawned
as children of the Java process
hosting SolarWinds Web Help Desk. This parent/child relationship is anomalous for
normal help desk
ticketing operations and is consistent with exploitation of unauthenticated RCE
/ deserialization
vulnerabilities (CVE-2025-40551, CVE-2025-40553) affecting versions prior to 2026.1.
'
references:
- https://www.solarwinds.com/web-help-desk
author: Vorant
tags:
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
selection_parent_svc:
ParentCommandLine|contains:
- WebHelpDesk
- helpdesk
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \sh
- \bash
- \wscript.exe
- \cscript.exe
filter_benign:
CommandLine|contains:
- backup.bat
- WebHelpDeskBackup
condition: selection_parent and selection_parent_svc and selection_child and not
filter_benign
falsepositives:
- Legitimate scheduled maintenance or backup scripts invoked by the Web Help Desk
service account
- Administrator-triggered diagnostic scripts executed via the application's built-in
scripting features
level: high
New Local Account Created by Web Help Desk Service Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of a new local user account by a process tree rooted in the SolarWinds Web Help Desk Java service, potentially indicating abuse of exploited RCE to create persistence accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Local Account Creation from Web Help Desk Process Tree
id: 8c297c27-4a29-5859-a6e5-d0ea040bd059
status: experimental
description: 'Detects net.exe or PowerShell account-creation commands (net user /add,
New-LocalUser) executed by a
process whose parent or grandparent is the Java process running SolarWinds Web Help
Desk. This behaviour
is consistent with post-exploitation account creation for persistence following
exploitation of
authentication bypass or RCE vulnerabilities described for Web Help Desk (CVE-2025-40551
through
CVE-2025-40554).
'
references:
- https://www.solarwinds.com/web-help-desk
author: Vorant
tags:
- attack.t1078
- attack.persistence
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
selection_cmd:
CommandLine|contains:
- net user
- net.exe user
- New-LocalUser
- net localgroup administrators
condition: selection_parent and selection_cmd
falsepositives:
- Administrative scripts run manually through a Java-based remote management console
with similar parentage
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-solarwinds-web-help-desk-could-allow-for-arbitrary-code-execution_2026-008
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs