Loading story…
SolarWinds warned that multiple vulnerabilities in Web Help Desk are being actively exploited, with reporting highlighting a critical flaw that can lead to remote code execution on exposed help-desk servers. Public references tie the activity to CVE-2025-40554, while additional SolarWinds advisories and third-party research point to related issues including CVE-2025-40552, CVE-2025-40553, and CVE-2025-40536, indicating a broader security problem affecting the product.
Security researchers and defenders published proof-of-concept material and detection guidance shortly after disclosure, including a watchTowr repository focused on Web Help Desk exploitation and a GitHub Gist describing uncommon process activity associated with compromise. The combination of vendor advisories, media reporting, and public exploit research indicates that attackers moved quickly to weaponize the flaws, increasing risk for organizations that have not patched, isolated, or monitored SolarWinds Web Help Desk deployments.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
SolarWinds published a Trust Center security advisory for CVE-2025-40554. The reference explicitly anchors this advisory to January 1, 2026.
watchTowr Labs published a GitHub repository focused on SolarWinds Web Help Desk vulnerabilities CVE-2025-40552 and CVE-2025-40553. This represents public release of additional technical material related to the flaws.
A GitHub Gist titled "SolarWinds Web Help Desk Exploitation - Uncommon Process Activity" was published, indicating technical detection details related to the exploitation activity were made available.
Microsoft reported that exploitation of Internet-exposed SolarWinds Web Help Desk servers, reportedly active since December 2025, involved RMM tooling, Velociraptor and Cloudflared abuse, TPMProfiler scheduled-task QEMU tunneling, defense evasion, and NTDS.dit extraction and DCSync. The initial-access CVE was not confirmed.
News coverage reported that a critical vulnerability in SolarWinds Web Help Desk was being actively exploited. Multiple outlets covered the same development in early February 2026.
SolarWinds published a Trust Center security advisory for CVE-2025-40536. This is the earliest explicitly dated event present in the references.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
8 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceelastic.co
Open sourcegist.github.com
Open sourcemicrosoft.com
Open sourcecybersecuritydive.com
Open sourceinfosecurity-magazine.com
Open sourcesolarwinds.com
Open sourcesolarwinds.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2025-26399** is a **critical insecure deserialization** flaw (CWE-502) in *SolarWinds Web Help Desk* that enables **unauthenticated remote code execution/command execution** over the network. The issue resides in the product’s **`AjaxProxy`** component, where untrusted serialized data can be processed without sufficient validation, allowing an attacker to deliver a crafted payload that results in arbitrary command execution on the host running the help desk application. Multiple reports indicate the vulnerability is **actively exploited in the wild**, prompting **CISA** to add CVE-2025-26399 to the **Known Exploited Vulnerabilities (KEV)** catalog. NetSPI notes the flaw was disclosed in 2025 and is described as a **patch bypass** related to earlier issues (**CVE-2024-28988** and **CVE-2024-28986**), and recommends immediate remediation by upgrading to **SolarWinds Web Help Desk 12.8.7 Hotfix 1 or later**; if patching is delayed, organizations should restrict network exposure of the server and increase monitoring for suspicious process execution and outbound connections.
Jun 29, 2026
SolarWinds issued another fix for **Web Help Desk** after attackers were found exploiting a patch bypass that left a previously addressed vulnerability still reachable. The report says the flaw was being actively exploited, forcing the company to reissue remediation guidance and update customers again to close the bypass condition. The incident highlights the operational risk of incomplete vulnerability remediation, where an initial patch can be circumvented and exposed systems remain vulnerable despite prior updates. Organizations running Web Help Desk were urged to apply the latest vendor fix immediately and verify that earlier mitigations had not left the product exposed to continued exploitation.
Jun 29, 2026
SolarWinds released security updates for **Web Help Desk (WHD)** to address two critical vulnerabilities affecting versions **12.4 through 12.8**. One issue, **`CVE-2024-28986`**, is a Java deserialization flaw that can lead to **remote code execution** and carries a **CVSS 9.8** rating; public reporting said the vulnerability was **actively exploited**. A second critical issue, tracked in SolarWinds advisories as **`CVE-2024-28987`**, involves **built-in accounts with default passwords** that could let attackers gain unauthorized remote access and modify data. SolarWinds advised customers to **upgrade to WHD 12.8.3** and apply **Hotfix 1** and **Hotfix 2**, with backups taken before installing the fixes. The vendor published a trust-center advisory for `CVE-2024-28987`, while external incident reporting highlighted the urgency of patching because the flaws could allow both full compromise of vulnerable servers and abuse of default credentials in exposed deployments.
Jul 24, 2026