---
title: "SolarWinds Web Help Desk: Exploited AjaxProxy RCE Chain"
url: https://erroneo.us/security/briefs/web-help-desk-cve-2025-40551-ajaxproxy-rce/
description: "Unauthenticated RCE in Web Help Desk 12.8.8 HF1 and earlier, used in 2026 intrusions linked to ransomware. Fixed in WHD 2026.1. Upgrade, then hunt."
type: security-brief
section: "Security Digest"
date_published: 2026-01-28
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-40551", "CVE-2025-40536", "CVE-2025-26399"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# SolarWinds Web Help Desk: Exploited AjaxProxy RCE Chain

**Verdict: Check exposure.** Exploited since at least December 2025 by an actor tied to ransomware; any WHD below 2026.1 should be isolated, upgraded and treated as compromised, and everyone else should confirm the version and hunt once.

- **Who must act:** Anyone running SolarWinds Web Help Desk 12.x (12.8.8 HF1 or earlier), above all where the WHD web interface was reachable from the internet at any point since December 2025.
- **Who can relax:** Organizations without Web Help Desk, or that upgraded to 2026.1 in late January 2026, kept WHD off the internet and found none of the indicators below.
- **Affected:** Web Help Desk 12.8.8 HF1 and all earlier versions (CVE-2025-40551, CVE-2025-40536); Web Help Desk 12.8.7 and earlier (CVE-2025-26399)
- **Fixed:** Web Help Desk 2026.1 (all three CVEs); Web Help Desk 12.8.7 HF1 (CVE-2025-26399 only; still vulnerable to the 2026 bugs); Current 2026.x release, e.g. 2026.2.1, recommended
- **CVEs:** CVE-2025-40551, CVE-2025-40536, CVE-2025-26399
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Record the version of every WHD server; anything on 12.x is vulnerable.
2. Upgrade to 2026.1, then to the current 2026.x release; SolarWinds says to stop at 2026.1 first when coming from 12.x.
3. Remove internet access to WHD; put it behind a VPN or an allow-list.
4. If a 12.x server was exposed, isolate it, collect logs, and treat it as compromised.
5. Reset WHD admin and service accounts and any domain credentials reachable from the host; check for DCSync.
6. Remove unauthorized Zoho ManageEngine/Assist agents, Velociraptor, cloudflared and the TPMProfiler task.

### How to check if you are affected

- Search WHD access logs (whd_access_log_*.txt) for 'bogus' or 'badparam=/ajax/' and application logs (whd_*.txt) for out-of-band (OAST) callbacks or org.jabsorb.JSONRPCBridge exceptions.
- Look for traffic from 178.128.210.172 and 137.184.229.230, which SolarWinds lists as suspicious.
- Flag wrapper.exe or java.exe under WebHelpDesk spawning cmd.exe, PowerShell, BITS or 'msiexec /q /i', and any ToolsIQ.exe on the host.
- Check for a scheduled task named TPMProfiler running QEMU, sspicli.dll loaded by wab.exe, Velociraptor 0.73.4 or cloudflared.
- Check domain controllers for replication (DCSync) requests from non-DC hosts.

## What happened

On January 28, 2026, SolarWinds released [Web Help Desk 2026.1](https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm), fixing six flaws. The one that matters most is [CVE-2025-40551](https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40551) (CVSS 9.8), an unauthenticated Java deserialization RCE. Jimi Sebree of Horizon3.ai reported it, along with [CVE-2025-40536](https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40536) (8.1), a security control bypass. [Horizon3](https://horizon3.ai/attack-research/cve-2025-40551/) explains the chain. The bypass reaches restricted WebObjects components, and the attacker then sends an unsafe object to AjaxProxy. That is the same component behind CVE-2024-28986, whose fixes were bypassed twice. The second bypass, [CVE-2025-26399](https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399), was disclosed in September 2025 and fixed in 12.8.7 HF1. Our separate brief on CVE-2024-28986 covers the 2024 history.

CISA added CVE-2025-40551 to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40551) on February 3, CVE-2025-40536 on February 12, and CVE-2025-26399 on March 9, 2026. It flags the last one as [known to be used in ransomware campaigns](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399).

## Who is affected

WHD 12.8.8 HF1 and all earlier versions are affected; 2026.1 fixes all three CVEs. The 12.8.7 HF1 hotfix closes only CVE-2025-26399. [Rapid7](https://www.rapid7.com/blog/post/etr-multiple-critical-solarwinds-web-help-desk-vulnerabilities-cve-2025-40551-40552-40553-40554) lists no workaround. The [2026.2.1 release notes](https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-2-1_release_notes.htm) (July 30, 2026) add a critical SAML bypass fix, CVE-2026-28323. They also tell 12.x users to go to 2026.1 first, and they set end of life for 12.4 through 12.8.8 at November 30, 2026.

## Do you really need to act?

If WHD 12.x is still running, yes, today. [Microsoft](https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/) saw intrusions through internet-facing WHD in December 2025. It could not say which CVE was used, because the hosts were vulnerable to old and new bugs alike. Attackers ran PowerShell and BITS, installed Zoho ManageEngine RMM, and used a `TPMProfiler` task to run a QEMU VM with SSH. They sideloaded `sspicli.dll` to reach LSASS and, in one case, ran DCSync. [Huntress](https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399) found three victims. The earliest persistence was installed on January 16, 2026. The attackers used Velociraptor 0.73.4 as C2, plus cloudflared tunnels. Huntress later found the same actor's [Elastic Cloud trial](https://www.huntress.com/blog/threat-actor-abuses-elastic-cloud-siem) holding data from about 216 hosts across 34 AD domains. [The Hacker News](https://thehackernews.com/2026/03/cisa-flags-solarwinds-ivanti-and.html) reports the activity is believed to be the Warlock ransomware crew's. If you moved to 2026.1 promptly and WHD was not public, one hunt is enough.

## What to do now

1. Record every WHD server's version. Anything on 12.x is vulnerable.
2. Upgrade to 2026.1, then to the current 2026.x release.
3. Take WHD off the internet. Put it behind a VPN or an allow-list.
4. If a 12.x server was exposed, isolate it, preserve its logs and treat it as compromised.
5. Reset WHD admin and service accounts and domain credentials reachable from the host.

## How to tell if you were hit

SolarWinds lists these indicators: `bogus` or `badparam=/ajax/` in `whd_access_log_*.txt`, OAST callbacks in `whd_*.txt`, and the IPs `178.128.210.172` and `137.184.229.230`. From the WHD install directory, run `Get-ChildItem -Recurse -Filter whd_access_log_*.txt | Select-String -Pattern 'badparam=/ajax/','bogus'` and `Get-ScheduledTask -TaskName TPMProfiler`. Huntress saw `wrapper.exe` → `java.exe` → `cmd.exe` → `msiexec /q /i`. It also lists `auth.qgtxtebl.workers[.]dev`, `v2-api.mooo[.]com`, `files.catbox[.]moe` and the Zoho Assist account `esmahyft@proton[.]me`. On domain controllers, check for replication requests from non-DC hosts. [BleepingComputer](https://www.bleepingcomputer.com/news/security/threat-actors-exploit-solarwinds-wdh-flaws-to-deploy-velociraptor/) also reports that Defender and the firewall were disabled.

## Timeline

- Sep 17, 2025 — SolarWinds discloses CVE-2025-26399 and ships 12.8.7 HF1.
- Jan 16, 2026 — Earliest persistence Huntress found.
- Jan 28, 2026 — WHD 2026.1 fixes CVE-2025-40551, CVE-2025-40536 and four more bugs.
- Feb 3, 2026 — CVE-2025-40551 added to KEV.
- Feb 6, 2026 — Microsoft publishes its findings; Huntress follows on February 8.
- Feb 12, 2026 — CVE-2025-40536 added to KEV.
- Mar 9, 2026 — CVE-2025-26399 added to KEV, flagged for ransomware use.
- Nov 30, 2026 — WHD 12.x end of life.

## Sources

1. [SolarWinds — CVE-2025-40551 Web Help Desk deserialization RCE advisory](https://www.solarwinds.com/trust-center/security-advisories/cve-2025-40551)
2. [SolarWinds — CVE-2025-40536 Web Help Desk security control bypass advisory](https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40536)
3. [SolarWinds — CVE-2025-26399 Web Help Desk AjaxProxy deserialization advisory](https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399)
4. [SolarWinds — WHD 2026.1 release notes](https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm)
5. [SolarWinds — WHD 2026.2.1 release notes](https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-2-1_release_notes.htm)
6. [CVE record — CVE-2025-40551](https://www.cve.org/CVERecord?id=CVE-2025-40551)
7. [CVE record — CVE-2025-40536](https://www.cve.org/CVERecord?id=CVE-2025-40536)
8. [CVE record — CVE-2025-26399](https://www.cve.org/CVERecord?id=CVE-2025-26399)
9. [CISA — Known Exploited Vulnerabilities: CVE-2025-40551](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-40551)
10. [CISA — Known Exploited Vulnerabilities: CVE-2025-26399](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399)
11. [Horizon3.ai — CVE-2025-40551 SolarWinds Web Help Desk](https://horizon3.ai/attack-research/cve-2025-40551/)
12. [Microsoft Security — Active exploitation of SolarWinds Web Help Desk](https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/)
13. [Huntress — Active exploitation of SolarWinds Web Help Desk (CVE-2025-26399)](https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399)
14. [Huntress — A threat actor abuses another free trial (Elastic Cloud)](https://www.huntress.com/blog/threat-actor-abuses-elastic-cloud-siem)
15. [Rapid7 — Multiple critical SolarWinds Web Help Desk vulnerabilities](https://www.rapid7.com/blog/post/etr-multiple-critical-solarwinds-web-help-desk-vulnerabilities-cve-2025-40551-40552-40553-40554)
16. [The Hacker News — CISA flags SolarWinds, Ivanti and Omnissa flaws](https://thehackernews.com/2026/03/cisa-flags-solarwinds-ivanti-and.html)
17. [BleepingComputer — Hackers exploit SolarWinds WHD flaws to deploy DFIR tool in attacks](https://www.bleepingcomputer.com/news/security/threat-actors-exploit-solarwinds-wdh-flaws-to-deploy-velociraptor/)

---
Source page: https://erroneo.us/security/briefs/web-help-desk-cve-2025-40551-ajaxproxy-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt