CVE-2025-40552: 
SolarWinds Web Help Desk vulnerability analysis and mitigation

CVE-2025-40552 is a critical authentication bypass vulnerability in SolarWinds Web Help Desk (WHD) that allows unauthenticated remote attackers to execute actions and methods that should be protected by authentication. It affects all versions of SolarWinds Web Help Desk up to and including 12.8.8 HF1, and was disclosed on January 28, 2026. The vulnerability was discovered by Piotr Bazydlo of watchTowr and carries a CVSS v3.1 base score of 9.8 (Critical) (SolarWinds Advisory, WHD Release Notes).

The vulnerability is classified as a weak authentication flaw (CWE-1390) in SolarWinds Web Help Desk's WebObjects-based application framework. An unauthenticated attacker can exploit the flaw by sending a crafted POST request to the WHD endpoint (/helpdesk/WebObjects/Helpdesk.woa/wo/1.2) with a wopage parameter set to a privileged page (e.g., LookAndFeelPref), which poisons the application's context cache and grants access to authenticated functionality without valid credentials. This bypass requires no user interaction, no privileges, and is exploitable over the network with low attack complexity. When chained with CVE-2025-40553 (a deserialization RCE vulnerability), the authentication bypass enables a full pre-authentication remote code execution chain (watchTowr PoC, Rapid7 ETR).

Successful exploitation allows an unauthenticated attacker to access and invoke protected administrative actions within SolarWinds Web Help Desk, resulting in high impact to confidentiality, integrity, and availability. When chained with CVE-2025-40553, attackers can achieve unauthenticated remote code execution, enabling full system compromise, arbitrary command execution on the host, data exfiltration, and potential lateral movement within the network. Over 170 internet-exposed WHD installations were identified as vulnerable, significantly broadening the attack surface (Rapid7 ETR, BleepingComputer).

A public proof-of-concept exploit combining CVE-2025-40552 and CVE-2025-40553 into a pre-authentication RCE chain was published by watchTowr on GitHub on March 2, 2026 (watchTowr PoC). CISA added a related SolarWinds WHD RCE vulnerability to its Known Exploited Vulnerabilities (KEV) catalog in early February 2026, confirming active in-the-wild exploitation (BleepingComputer). Detection templates for this vulnerability have been added to ProjectDiscovery's Nuclei templates and Emerging Threats rulesets. The EPSS score is approximately 0.046% (low probability of exploitation in the next 30 days as of initial scoring), though active exploitation has been confirmed. No specific threat actor attribution has been publicly reported.

1. Reconnaissance: Identify internet-facing SolarWinds Web Help Desk instances (versions ≤ 12.8.8 HF1) using tools like Shodan or Censys, searching for the WHD web interface at /helpdesk/WebObjects/Helpdesk.woa.
2. Session Initialization (CVE-2025-40552): Send a GET request to https://<target>/helpdesk/WebObjects/Helpdesk.woa to obtain a valid CSRF token from the XSRF-TOKEN cookie in the response headers.
3. Cache Poisoning / Auth Bypass: Send a crafted POST request to https://<target>/helpdesk/WebObjects/Helpdesk.woa/wo/1.2 with headers X-Xsrf-Token: <csrf> and Content-Type: application/x-www-form-urlencoded, and body wopage=LookAndFeelPref. A response containing JSONRpcClient and Logo should be confirms successful authentication bypass.
4. RCE via Deserialization (CVE-2025-40553): Using the authenticated session, send a POST request to https://<target>/helpdesk/WebObjects/Helpdesk.woa/ajax/2.0.7.1.1.1 with a JSON payload specifying org.apache.commons.dbcp2.BasicDataSource as the Java class, targeting the local PostgreSQL instance and injecting a COPY FROM PROGRAM SQL command (e.g., cmd.exe /c whoami) to achieve OS-level command execution.
5. Post-Exploitation: Use the established RCE to deploy a reverse shell, exfiltrate sensitive help desk data (tickets, credentials, user information), or pivot to other internal systems (watchTowr PoC, Rapid7 ETR).

• Network: Unusual POST requests to /helpdesk/WebObjects/Helpdesk.woa/wo/1.2 with body parameter wopage=LookAndFeelPref from unauthenticated sources; POST requests to /helpdesk/WebObjects/Helpdesk.woa/ajax/2.0.7.1.1.1 containing BasicDataSource or COPY FROM PROGRAM in the body; unexpected outbound connections from the WHD server to external IPs.
• Logs: WHD access logs showing repeated unauthenticated requests to /wo/1.2 or /ajax/2.0.7.1.1.1 endpoints; PostgreSQL logs showing COPY FROM PROGRAM statements or creation of unexpected tables with names matching pattern SWWHDDAG[a-z0-9]{8}.
• File System: Unexpected new files or scripts in the Web Help Desk installation directory (C:\Program Files\WebHelpDesk\ on Windows); new scheduled tasks or services created by the WHD service account.
• Process: Unusual child processes spawned by the WHD Java process (e.g., cmd.exe, powershell.exe, bash, curl, wget); unexpected database table creation in the WHD PostgreSQL instance (watchTowr PoC).

SolarWinds has released a patch in Web Help Desk version 2026.1, which addresses CVE-2025-40552 along with three other critical vulnerabilities (CVE-2025-40551, CVE-2025-40553, CVE-2025-40554). All users running WHD 12.8.8 HF1 or earlier should upgrade to version 2026.1 immediately. As interim measures, organizations should implement network segmentation to restrict access to WHD instances, limit exposure of the WHD web interface to trusted networks only, and monitor for anomalous requests to the affected endpoints (SolarWinds Advisory, WHD Release Notes).

SolarWinds credited Piotr Bazydlo of watchTowr for responsible disclosure of CVE-2025-40552 and CVE-2025-40553 (SolarWinds Advisory). Rapid7 published an emergency threat response covering all four critical WHD vulnerabilities, noting the severity of the pre-auth RCE chain (Rapid7 ETR). BleepingComputer and The Hacker News covered the CISA KEV addition and active exploitation, drawing significant community attention on Reddit and social media platforms. CSO Online noted that the vulnerabilities "reopen old wounds" given SolarWinds' history with the 2020 supply chain attack, reflecting broader industry concern about the vendor's security posture (BleepingComputer).