SolarWinds Web Help Desk has multiple critical vulnerabilities including unauthenticated…
SolarWinds Web Help Desk has multiple critical vulnerabilities including unauthenticated RCE via deserialization, allowing SYSTEM-level code execution.
Multiple critical vulnerabilities have been discovered in SolarWinds Web Help Desk versions prior to 2026.1. The most severe flaws include unauthenticated remote code execution via deserialization (CVE-2025-40551, CVE-2025-40553), multiple authentication bypass vulnerabilities (CVE-2025-40552, CVE-2025-40554), security control bypass (CVE-2025-40536), and hardcoded credentials (CVE-2025-40537). Successful exploitation could allow an unauthenticated attacker to execute arbitrary code with SYSTEM privileges, enabling full system compromise including program installation, data manipulation, and account creation.
The vulnerabilities affect SolarWinds Web Help Desk, a web-based IT service management platform used for help desk ticketing and asset management. The combination of unauthenticated access and code execution capabilities presents a severe risk to organizations running vulnerable versions. MS-ISAC has issued this advisory with immediate patching recommendations, though there are currently no reports of active exploitation in the wild.
Organizations are strongly advised to apply updates to version 2026.1 immediately after testing. Additional mitigations include implementing network segmentation, applying least privilege principles, conducting vulnerability scans, and reviewing service account inventories to limit exposure of internet-facing instances.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by SolarWinds Web Help Desk Java Process
Detects a shell or scripting interpreter spawned by the Java process running SolarWinds Web Help Desk, indicative of exploitation of an unauthenticated deserialization or RCE vulnerability (CVE-2025-40551/40553). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Spawned from SolarWinds Web Help Desk Java Process
id: 52ed0809-bbce-5580-b751-03acace875df
status: experimental
description: 'Detects command interpreters (cmd.exe, powershell.exe, sh, bash) spawned
as children of the Java process
hosting SolarWinds Web Help Desk. This parent/child relationship is anomalous for
normal help desk
ticketing operations and is consistent with exploitation of unauthenticated RCE
/ deserialization
vulnerabilities (CVE-2025-40551, CVE-2025-40553) affecting versions prior to 2026.1.
'
references:
- https://www.solarwinds.com/web-help-desk
author: Vorant
tags:
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
selection_parent_svc:
ParentCommandLine|contains:
- WebHelpDesk
- helpdesk
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \sh
- \bash
- \wscript.exe
- \cscript.exe
filter_benign:
CommandLine|contains:
- backup.bat
- WebHelpDeskBackup
condition: selection_parent and selection_parent_svc and selection_child and not
filter_benign
falsepositives:
- Legitimate scheduled maintenance or backup scripts invoked by the Web Help Desk
service account
- Administrator-triggered diagnostic scripts executed via the application's built-in
scripting features
level: high
Suspicious Outbound Connection from SolarWinds Web Help Desk Process
Detects the Web Help Desk Java process initiating outbound network connections shortly after spawning a shell, consistent with post-exploitation payload download or C2 callback following RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Help Desk Java Process Making Outbound Network Connection After Shell Spawn
id: 3f7109a2-60c7-596a-8dca-c8379c309740
status: experimental
description: 'Detects network connections initiated by cmd.exe, powershell.exe, or
scripting hosts that were spawned
from the Java process running SolarWinds Web Help Desk. This pattern is consistent
with payload retrieval
or command-and-control callback following successful exploitation of an unauthenticated
RCE vulnerability
in Web Help Desk (CVE-2025-40551, CVE-2025-40553).
'
references:
- https://www.solarwinds.com/web-help-desk
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
category: network_connection
product: windows
detection:
selection_image:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
selection_conn:
Initiated: true
condition: selection_image and selection_parent and selection_conn
falsepositives:
- Internal automation scripts on the Web Help Desk server performing legitimate outbound
checks or updates
- Monitoring or backup agents that legitimately spawn scripting hosts with network
access
level: medium
New Local Account Created by Web Help Desk Service Process
Detects creation of a new local user account by a process tree rooted in the SolarWinds Web Help Desk Java service, potentially indicating abuse of exploited RCE to create persistence accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Local Account Creation from Web Help Desk Process Tree
id: 8c297c27-4a29-5859-a6e5-d0ea040bd059
status: experimental
description: 'Detects net.exe or PowerShell account-creation commands (net user /add,
New-LocalUser) executed by a
process whose parent or grandparent is the Java process running SolarWinds Web Help
Desk. This behaviour
is consistent with post-exploitation account creation for persistence following
exploitation of
authentication bypass or RCE vulnerabilities described for Web Help Desk (CVE-2025-40551
through
CVE-2025-40554).
'
references:
- https://www.solarwinds.com/web-help-desk
author: Vorant
tags:
- attack.t1078
- attack.persistence
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \java.exe
- \javaw.exe
selection_cmd:
CommandLine|contains:
- net user
- net.exe user
- New-LocalUser
- net localgroup administrators
condition: selection_parent and selection_cmd
falsepositives:
- Administrative scripts run manually through a Java-based remote management console
with similar parentage
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-solarwinds-web-help-desk-could-allow-for-arbitrary-code-execution_2026-008
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free