Critical Solarwinds Web Flaw Enables Remote Code Execution

Horizon3.ai researchers have uncovered multiple critical vulnerabilities within SolarWinds Web Help Desk (WHD). These flaws ultimately culminate in <

These flaws chain static credentials, security bypasses, and deserialization weaknesses, affecting versions prior to 2026.1.

SolarWinds WHD, an IT service management platform for ticketing and asset tracking, has faced repeated deserialization issues.

In 2024, CVE-2024-28986 enabled RCE via AjaxProxy and was added to CISA’s Known Exploited Vulnerabilities catalog; patches were bypassed by CVE-2024-28988 and CVE-2025-26399.

The latest chain exploits similar paths, bypassing sanitization in JSON-RPC handling.

The flaws include hardcoded credentials, CSRF and request-filter bypasses, and unsafe deserialization in the jabsorb library.​

Attackers bypass whitelists by altering URIs from “/ajax/” to “/wo/”, create components with “wopage”, and inject gadgets like JNDI lookups.​

Exploit Chain

Unauthenticated attackers start by creating a session on the login page to extract wosid and XSRF tokens.

They bypass filters with “?badparam=/ajax/&wopage=LoginPref” to instantiate LoginPref, enabling AjaxProxy access, then POST malicious JSON payloads via JSONRPC for deserialization.

A Nuclei template demonstrates JNDI lookup to external servers, confirming RCE potential.​

Monitor logs in <Install>/logs/ for exploitation signs.​

Unusual IPs hitting restricted endpoints signal compromise.​

Mitigations

Upgrade immediately to WHD 2026.1, which addresses these issues, according to SolarWinds’ release notes. Review configurations to disable default accounts and enforce strict request filtering.

Coverage exists in tools like NodeZero; monitor CISA advisories for exploitation updates.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.