# SolarWinds Web Help Desk has multiple critical vulnerabilities including unauthenticated…

Published: 2026-01-28 · Severity: critical
Canonical: https://vorant.io/reports/cb28afe2-be0e-4f40-8644-0807007f9d3a/solarwinds-web-help-desk-has-multiple-critical-vulnerabilities-including

> SolarWinds Web Help Desk has multiple critical vulnerabilities including unauthenticated RCE via deserialization, allowing SYSTEM-level code execution.

Multiple critical vulnerabilities have been discovered in SolarWinds Web Help Desk versions prior to 2026.1. The most severe flaws include unauthenticated remote code execution via deserialization (CVE-2025-40551, CVE-2025-40553), multiple authentication bypass vulnerabilities (CVE-2025-40552, CVE-2025-40554), security control bypass (CVE-2025-40536), and hardcoded credentials (CVE-2025-40537). Successful exploitation could allow an unauthenticated attacker to execute arbitrary code with SYSTEM privileges, enabling full system compromise including program installation, data manipulation, and account creation.

The vulnerabilities affect SolarWinds Web Help Desk, a web-based IT service management platform used for help desk ticketing and asset management. The combination of unauthenticated access and code execution capabilities presents a severe risk to organizations running vulnerable versions. MS-ISAC has issued this advisory with immediate patching recommendations, though there are currently no reports of active exploitation in the wild.

Organizations are strongly advised to apply updates to version 2026.1 immediately after testing. Additional mitigations include implementing network segmentation, applying least privilege principles, conducting vulnerability scans, and reviewing service account inventories to limit exposure of internet-facing instances.

## Mentioned in this report

- Vulnerabilities: CVE-2025-40536 (KEV), CVE-2025-40537, CVE-2025-40551 (KEV), CVE-2025-40552 (templated), CVE-2025-40553, CVE-2025-40554 (templated)

## Detection guidance (public sample)

### Suspicious Child Process Spawned by SolarWinds Web Help Desk Java Process

ATT&CK: T1190

Detects a shell or scripting interpreter spawned by the Java process running SolarWinds Web Help Desk, indicative of exploitation of an unauthenticated deserialization or RCE vulnerability (CVE-2025-40551/40553). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shell Spawned from SolarWinds Web Help Desk Java Process
id: 52ed0809-bbce-5580-b751-03acace875df
status: experimental
description: 'Detects command interpreters (cmd.exe, powershell.exe, sh, bash) spawned
  as children of the Java process

  hosting SolarWinds Web Help Desk. This parent/child relationship is anomalous for
  normal help desk

  ticketing operations and is consistent with exploitation of unauthenticated RCE
  / deserialization

  vulnerabilities (CVE-2025-40551, CVE-2025-40553) affecting versions prior to 2026.1.

  '
references:
- https://www.solarwinds.com/web-help-desk
author: Vorant
tags:
- attack.t1190
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
  selection_parent_svc:
    ParentCommandLine|contains:
    - WebHelpDesk
    - helpdesk
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \sh
    - \bash
    - \wscript.exe
    - \cscript.exe
  filter_benign:
    CommandLine|contains:
    - backup.bat
    - WebHelpDeskBackup
  condition: selection_parent and selection_parent_svc and selection_child and not
    filter_benign
falsepositives:
- Legitimate scheduled maintenance or backup scripts invoked by the Web Help Desk
  service account
- Administrator-triggered diagnostic scripts executed via the application's built-in
  scripting features
level: high
```

### Suspicious Outbound Connection from SolarWinds Web Help Desk Process

ATT&CK: T1203

Detects the Web Help Desk Java process initiating outbound network connections shortly after spawning a shell, consistent with post-exploitation payload download or C2 callback following RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Help Desk Java Process Making Outbound Network Connection After Shell Spawn
id: 3f7109a2-60c7-596a-8dca-c8379c309740
status: experimental
description: 'Detects network connections initiated by cmd.exe, powershell.exe, or
  scripting hosts that were spawned

  from the Java process running SolarWinds Web Help Desk. This pattern is consistent
  with payload retrieval

  or command-and-control callback following successful exploitation of an unauthenticated
  RCE vulnerability

  in Web Help Desk (CVE-2025-40551, CVE-2025-40553).

  '
references:
- https://www.solarwinds.com/web-help-desk
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
  selection_conn:
    Initiated: true
  condition: selection_image and selection_parent and selection_conn
falsepositives:
- Internal automation scripts on the Web Help Desk server performing legitimate outbound
  checks or updates
- Monitoring or backup agents that legitimately spawn scripting hosts with network
  access
level: medium
```

### New Local Account Created by Web Help Desk Service Process

ATT&CK: T1078

Detects creation of a new local user account by a process tree rooted in the SolarWinds Web Help Desk Java service, potentially indicating abuse of exploited RCE to create persistence accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Local Account Creation from Web Help Desk Process Tree
id: 8c297c27-4a29-5859-a6e5-d0ea040bd059
status: experimental
description: 'Detects net.exe or PowerShell account-creation commands (net user /add,
  New-LocalUser) executed by a

  process whose parent or grandparent is the Java process running SolarWinds Web Help
  Desk. This behaviour

  is consistent with post-exploitation account creation for persistence following
  exploitation of

  authentication bypass or RCE vulnerabilities described for Web Help Desk (CVE-2025-40551
  through

  CVE-2025-40554).

  '
references:
- https://www.solarwinds.com/web-help-desk
author: Vorant
tags:
- attack.t1078
- attack.persistence
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \java.exe
    - \javaw.exe
  selection_cmd:
    CommandLine|contains:
    - net user
    - net.exe user
    - New-LocalUser
    - net localgroup administrators
  condition: selection_parent and selection_cmd
falsepositives:
- Administrative scripts run manually through a Java-based remote management console
  with similar parentage
level: high
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-solarwinds-web-help-desk-could-allow-for-arbitrary-code-execution_2026-008

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/cb28afe2-be0e-4f40-8644-0807007f9d3a/solarwinds-web-help-desk-has-multiple-critical-vulnerabilities-including.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup