erroneo.us
Search all guides⌘K

Security Digest · Jan 28, 2026 · Vulnerability · Other

SolarWinds Web Help Desk: Exploited AjaxProxy RCE Chain

Unauthenticated RCE in Web Help Desk 12.8.8 HF1 and earlier, used in 2026 intrusions linked to ransomware. Fixed in WHD 2026.1. Upgrade, then hunt.

Published By erroneo.us Security Desk · Updated 3 min read17 sources

Our verdict

Check exposure

Exploited since at least December 2025 by an actor tied to ransomware; any WHD below 2026.1 should be isolated, upgraded and treated as compromised, and everyone else should confirm the version and hunt once.

Who must act: Anyone running SolarWinds Web Help Desk 12.x (12.8.8 HF1 or earlier), above all where the WHD web interface was reachable from the internet at any point since December 2025.

Who can relax: Organizations without Web Help Desk, or that upgraded to 2026.1 in late January 2026, kept WHD off the internet and found none of the indicators below.

Affected
Web Help Desk 12.8.8 HF1 and all earlier versions (CVE-2025-40551, CVE-2025-40536)
Web Help Desk 12.8.7 and earlier (CVE-2025-26399)
Fixed in
Web Help Desk 2026.1 (all three CVEs)
Web Help Desk 12.8.7 HF1 (CVE-2025-26399 only; still vulnerable to the 2026 bugs)
Current 2026.x release, e.g. 2026.2.1, recommended
CVSS
9.8 (v3.1, CNA)
EPSS
90.1% (percentile 99.8)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Record the version of every WHD server; anything on 12.x is vulnerable.
  2. Upgrade to 2026.1, then to the current 2026.x release; SolarWinds says to stop at 2026.1 first when coming from 12.x.
  3. Remove internet access to WHD; put it behind a VPN or an allow-list.
  4. If a 12.x server was exposed, isolate it, collect logs, and treat it as compromised.
  5. Reset WHD admin and service accounts and any domain credentials reachable from the host; check for DCSync.
  6. Remove unauthorized Zoho ManageEngine/Assist agents, Velociraptor, cloudflared and the TPMProfiler task.

How to check if you are affected or compromised

  • Search WHD access logs (whd_access_log_*.txt) for 'bogus' or 'badparam=/ajax/' and application logs (whd_*.txt) for out-of-band (OAST) callbacks or org.jabsorb.JSONRPCBridge exceptions.
  • Look for traffic from 178.128.210.172 and 137.184.229.230, which SolarWinds lists as suspicious.
  • Flag wrapper.exe or java.exe under WebHelpDesk spawning cmd.exe, PowerShell, BITS or 'msiexec /q /i', and any ToolsIQ.exe on the host.
  • Check for a scheduled task named TPMProfiler running QEMU, sspicli.dll loaded by wab.exe, Velociraptor 0.73.4 or cloudflared.
  • Check domain controllers for replication (DCSync) requests from non-DC hosts.

What happened#

On January 28, 2026, SolarWinds released Web Help Desk 2026.1, fixing six flaws. The one that matters most is CVE-2025-40551 (CVSS 9.8), an unauthenticated Java deserialization RCE. Jimi Sebree of Horizon3.ai reported it, along with CVE-2025-40536 (8.1), a security control bypass. Horizon3 explains the chain. The bypass reaches restricted WebObjects components, and the attacker then sends an unsafe object to AjaxProxy. That is the same component behind CVE-2024-28986, whose fixes were bypassed twice. The second bypass, CVE-2025-26399, was disclosed in September 2025 and fixed in 12.8.7 HF1. Our separate brief on CVE-2024-28986 covers the 2024 history.

CISA added CVE-2025-40551 to KEV on February 3, CVE-2025-40536 on February 12, and CVE-2025-26399 on March 9, 2026. It flags the last one as known to be used in ransomware campaigns.

Who is affected#

WHD 12.8.8 HF1 and all earlier versions are affected; 2026.1 fixes all three CVEs. The 12.8.7 HF1 hotfix closes only CVE-2025-26399. Rapid7 lists no workaround. The 2026.2.1 release notes (July 30, 2026) add a critical SAML bypass fix, CVE-2026-28323. They also tell 12.x users to go to 2026.1 first, and they set end of life for 12.4 through 12.8.8 at November 30, 2026.

Do you really need to act?#

If WHD 12.x is still running, yes, today. Microsoft saw intrusions through internet-facing WHD in December 2025. It could not say which CVE was used, because the hosts were vulnerable to old and new bugs alike. Attackers ran PowerShell and BITS, installed Zoho ManageEngine RMM, and used a TPMProfiler task to run a QEMU VM with SSH. They sideloaded sspicli.dll to reach LSASS and, in one case, ran DCSync. Huntress found three victims. The earliest persistence was installed on January 16, 2026. The attackers used Velociraptor 0.73.4 as C2, plus cloudflared tunnels. Huntress later found the same actor's Elastic Cloud trial holding data from about 216 hosts across 34 AD domains. The Hacker News reports the activity is believed to be the Warlock ransomware crew's. If you moved to 2026.1 promptly and WHD was not public, one hunt is enough.

What to do now#

  1. Record every WHD server's version. Anything on 12.x is vulnerable.
  2. Upgrade to 2026.1, then to the current 2026.x release.
  3. Take WHD off the internet. Put it behind a VPN or an allow-list.
  4. If a 12.x server was exposed, isolate it, preserve its logs and treat it as compromised.
  5. Reset WHD admin and service accounts and domain credentials reachable from the host.

How to tell if you were hit#

SolarWinds lists these indicators: bogus or badparam=/ajax/ in whd_access_log_*.txt, OAST callbacks in whd_*.txt, and the IPs 178.128.210.172 and 137.184.229.230. From the WHD install directory, run Get-ChildItem -Recurse -Filter whd_access_log_*.txt | Select-String -Pattern 'badparam=/ajax/','bogus' and Get-ScheduledTask -TaskName TPMProfiler. Huntress saw wrapper.exe → java.exe → cmd.exe → msiexec /q /i. It also lists auth.qgtxtebl.workers[.]dev, v2-api.mooo[.]com, files.catbox[.]moe and the Zoho Assist account esmahyft@proton[.]me. On domain controllers, check for replication requests from non-DC hosts. BleepingComputer also reports that Defender and the firewall were disabled.

Timeline#

  • — SolarWinds discloses CVE-2025-26399 and ships 12.8.7 HF1.
  • — Earliest persistence Huntress found.
  • — WHD 2026.1 fixes CVE-2025-40551, CVE-2025-40536 and four more bugs.
  • — CVE-2025-40551 added to KEV.
  • — Microsoft publishes its findings; Huntress follows on February 8.
  • — CVE-2025-40536 added to KEV.
  • — CVE-2025-26399 added to KEV, flagged for ransomware use.
  • — WHD 12.x end of life.

Vulnerability records

  • CVE-2025-40551 · KEV 2026-02-03 · SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would…
  • CVE-2025-40536 · KEV 2026-02-12 · SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to…
  • CVE-2025-26399 · KEV 2026-03-09 · SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. SolarWinds — CVE-2025-40551 Web Help Desk deserialization RCE advisory solarwinds.com
  2. SolarWinds — CVE-2025-40536 Web Help Desk security control bypass advisory solarwinds.com
  3. SolarWinds — CVE-2025-26399 Web Help Desk AjaxProxy deserialization advisory solarwinds.com
  4. SolarWinds — WHD 2026.1 release notes documentation.solarwinds.com
  5. SolarWinds — WHD 2026.2.1 release notes documentation.solarwinds.com
  6. CVE record — CVE-2025-40551 cve.org
  7. CVE record — CVE-2025-40536 cve.org
  8. CVE record — CVE-2025-26399 cve.org
  9. CISA — Known Exploited Vulnerabilities: CVE-2025-40551 cisa.gov
  10. CISA — Known Exploited Vulnerabilities: CVE-2025-26399 cisa.gov
  11. Horizon3.ai — CVE-2025-40551 SolarWinds Web Help Desk horizon3.ai
  12. Microsoft Security — Active exploitation of SolarWinds Web Help Desk microsoft.com
  13. Huntress — Active exploitation of SolarWinds Web Help Desk (CVE-2025-26399) huntress.com
  14. Huntress — A threat actor abuses another free trial (Elastic Cloud) huntress.com
  15. Rapid7 — Multiple critical SolarWinds Web Help Desk vulnerabilities rapid7.com

Coverage and analysis

  1. The Hacker News — CISA flags SolarWinds, Ivanti and Omnissa flaws thehackernews.com
  2. BleepingComputer — Hackers exploit SolarWinds WHD flaws to deploy DFIR tool in attacks bleepingcomputer.com