CVE-2025-40553: 
SolarWinds Web Help Desk vulnerability analysis and mitigation

CVE-2025-40553 is a critical deserialization of untrusted data vulnerability in SolarWinds Web Help Desk that enables unauthenticated remote code execution (RCE). Discovered by Piotr Bazydlo of watchTowr and disclosed on January 28, 2026, it affects all versions of SolarWinds Web Help Desk up to and including 12.8.8 HF1. The fixed release is Web Help Desk 2026.1 (also referred to as 12.8.8 HF2). It carries a CVSS v3.1 base score of 9.8 (Critical) (SolarWinds Advisory, WHD Release Notes).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The flaw resides in the AJAX endpoint (/helpdesk/WebObjects/Helpdesk.woa/ajax/) of SolarWinds Web Help Desk, which accepts and deserializes attacker-controlled Java objects — specifically, it can be manipulated to instantiate org.apache.commons.dbcp2.BasicDataSource with attacker-supplied parameters, enabling arbitrary SQL execution via PostgreSQL's COPY FROM PROGRAM feature. This deserialization vulnerability (CVE-2025-40553) is chained with an authentication bypass (CVE-2025-40552) that poisons the context cache via the LookAndFeelPref page, granting unauthenticated access to protected endpoints. No authentication, user interaction, or elevated privileges are required for exploitation (watchTowr PoC, GitHub PoC).

Successful exploitation results in complete compromise of the affected SolarWinds Web Help Desk host — attackers can execute arbitrary operating system commands as the service account, leading to full loss of confidentiality, integrity, and availability. Because Web Help Desk is an IT service management platform often integrated with Active Directory and internal ticketing systems, a compromised instance can serve as a pivot point for lateral movement into broader enterprise infrastructure. Sensitive data including IT asset inventories, credentials, and internal communications stored within the help desk system are at risk of exfiltration (SolarWinds Advisory, Rapid7 ETR).

CVE-2025-40553 has been confirmed as actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog in early February 2026. A public proof-of-concept exploit script chaining CVE-2025-40552 and CVE-2025-40553 was published by watchTowr's Piotr Bazydlo, and a Nuclei detection template was added to the ProjectDiscovery repository. Arctic Wolf also reported active exploitation. The EPSS score is approximately 0.78%, though real-world exploitation activity has been confirmed. Approximately 170 internet-exposed SolarWinds Web Help Desk installations were identified as vulnerable at the time of disclosure (Arctic Wolf, watchTowr Blog, The Hacker News).

1. Reconnaissance: Use Shodan, Censys, or similar tools to identify internet-facing SolarWinds Web Help Desk instances running versions ≤ 12.8.8 HF1, typically accessible on port 443 or 8080 at /helpdesk/WebObjects/Helpdesk.woa.
2. Session initialization (CVE-2025-40552 auth bypass): Send a GET request to /helpdesk/WebObjects/Helpdesk.woa to obtain a valid XSRF-TOKEN cookie from the Set-Cookie response header.
3. Cache poisoning: Send a POST request to /helpdesk/WebObjects/Helpdesk.woa/wo/1.2 with the header X-Xsrf-Token and body parameter wopage=LookAndFeelPref. A successful response containing JSONRpcClient and Logo should be confirms the authentication bypass (CVE-2025-40552) is effective, poisoning the context cache to grant access to authenticated endpoints.
4. Deserialization payload delivery (CVE-2025-40553): Send a crafted POST request to /helpdesk/WebObjects/Helpdesk.woa/ajax/2.0.7.1.1.1 with a JSON body specifying javaClass: org.apache.commons.dbcp2.BasicDataSource and a malicious url parameter pointing to the local PostgreSQL instance (jdbc:postgresql://127.0.0.1:20293/postgres?user=whd).
5. Command execution: Set the validationQuery field to a PostgreSQL COPY FROM PROGRAM statement (e.g., CREATE TABLE <name>(output text); COPY <name> FROM PROGRAM 'cmd.exe /c whoami') to execute arbitrary OS commands on the server.
6. Post-exploitation: Retrieve command output from the created database table, establish persistence, exfiltrate credentials, or pivot to connected internal systems (watchTowr Blog, GitHub PoC).

• Network: Unusual POST requests to /helpdesk/WebObjects/Helpdesk.woa/wo/1.2 with body parameter wopage=LookAndFeelPref; POST requests to /helpdesk/WebObjects/Helpdesk.woa/ajax/2.0.7.1.1.1 containing BasicDataSource or dbcp2 in the body; outbound connections from the WHD server to unexpected external hosts.
• Logs: Web Help Desk access logs showing repeated requests to the AJAX endpoint with JSON payloads referencing org.apache.commons.dbcp2.BasicDataSource; PostgreSQL logs showing COPY FROM PROGRAM statements or creation of unexpected tables with names matching the pattern SWWHDDAG[a-z0-9]{8}.
• Database: Presence of unexpected tables in the WHD PostgreSQL database, particularly those prefixed with SWWHDDAG containing command output text.
• Process: Unexpected child processes spawned by the WHD Java process or PostgreSQL process (e.g., cmd.exe, whoami, powershell.exe, bash, curl, wget); new scheduled tasks or services created under the WHD service account.
• File System: New or modified files in the Web Help Desk installation directory; web shells or scripts dropped in accessible web directories (watchTowr Blog, Arctic Wolf).

SolarWinds has released Web Help Desk version 2026.1 (also referred to as 12.8.8 HF2) to address CVE-2025-40553 and related vulnerabilities. All organizations running Web Help Desk 12.8.8 HF1 or earlier should upgrade immediately. As an interim measure while patching is being prepared, restrict network access to the Web Help Desk interface to trusted IP ranges only, and ensure the application is not directly internet-facing. CISA has mandated that federal agencies remediate this vulnerability under the KEV directive (SolarWinds Advisory, WHD Release Notes).

The disclosure generated significant attention across the security community, with BleepingComputer, The Hacker News, Security Affairs, and CSO Online all covering the vulnerabilities. CSO Online noted that the flaws "reopen old wounds" given SolarWinds' history with the 2020 supply chain attack, highlighting ongoing concerns about the vendor's security posture. Rapid7 published an emergency threat response (ETR) covering all four critical CVEs disclosed simultaneously. The Belgium Centre for Cybersecurity (CCB) issued an advisory urging immediate patching. Social media discussion was active on Mastodon, Bluesky, and Reddit's r/SecOpsDaily, with DarkWebInformer amplifying the disclosure. watchTowr's detailed technical write-up and public PoC release drew particular attention from the research community (BleepingComputer, Rapid7 ETR, CSO Online).