Full Report
Huntress has observed active exploitation of a deserialization and remote code execution against the SolarWinds Web Help Desk software (CVE-2025-26399).
Analysis Summary
# Vulnerability: SolarWinds Web Help Desk Deserialization RCE
## CVE Details
- **CVE ID**: CVE-2025-26399 (associated with CVE-2025-40551)
- **CVSS Score**: 9.8 (Critical) - *Based on typical score for unauthenticated RCE via deserialization*
- **CWE**: CWE-502 (Deserialization of Untrusted Data)
## Affected Systems
- **Products**: SolarWinds Web Help Desk (WHD)
- **Versions**: All versions prior to **12.8.7 Hotfix 1 (HF1)**
- **Configurations**: Systems where the WHD service wrapper (`wrapper.exe`) and underlying Java/Tomcat application are exposed to the network.
## Vulnerability Description
The vulnerability is a Java deserialization flaw that allows an unauthenticated adversary to execute arbitrary code. By sending a specially crafted request containing a malicious serialized object, an attacker can force the application to execute commands with the privileges of the WHD service (typically SYSTEM or a high-privileged service account).
## Exploitation
- **Status**: **Exploited in the wild.** Observed by Huntress and Microsoft (February 2026).
- **Complexity**: Low
- **Attack Vector**: Network
- **PoC Availability**: Public technical details available; weaponized exploits are currently being used by threat actors.
## Impact
- **Confidentiality**: High (Full access to help desk data and system files)
- **Integrity**: High (Ability to modify system configurations and install malware)
- **Availability**: High (Ability to crash the service or encrypt files)
## Remediation
### Patches
- Update to **SolarWinds Web Help Desk 12.8.7 HF1** or the latest available version immediately.
- Patches can be found via the SolarWinds Success Center: `hxxps://documentation.solarwinds[.]com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm`
### Workarounds
- Isolate the Web Help Desk instance from the public internet.
- Restrict access to the WHD web interface via VPN or strict IP allow-listing.
## Detection
### Indicators of Compromise (IoCs)
- **Process Parentage**: `wrapper.exe` -> `java.exe` -> `cmd.exe` or `powershell.exe`.
- **Malicious Domains/Files**:
- `files.catbox[.]moe` (Used for staging payloads)
- `esmahyft@proton[.]me` (Account linked to malicious Zoho Assist agents)
- **Tooling**: Presence of unauthorized remote management tools (Zoho Assist, Cloudflare Tunnels) or DFIR tools used maliciously (Velociraptor).
### Detection Methods
- **File System**: Check `C:\Program Files\WebHelpDesk\version.txt` to confirm if you are running a vulnerable version.
- **SIEM/EDR**: Monitor for `msiexec` calls originating from Java processes, particularly those reaching out to external file-hosting domains.
## References
- SolarWinds Release Notes: `hxxps://documentation.solarwinds[.]com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm`
- Huntress Blog: `hxxps://www.huntress[.]com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399`
- Microsoft Security Blog: `hxxps://www.microsoft[.]com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/`
- CISA KEV Catalog: `hxxps://www.cisa[.]gov/known-exploited-vulnerabilities-catalog`