SolarWinds Web Help Desk < 2026.1 - Unauthenticated JNDI Injection RCE
SolarWinds Web Help Desk before version 2026.1 contains an insecure deserialization vulnerability in the jabsorb JSON-RPC library. When chained with a CSRF whitelist bypass (CVE-2025-40536), remote unauthenticated attackers can exploit JNDI injection via the Apache Xalan JNDIConnectionPool class to achieve remote code execution. The bypass involves including "/ajax/" in a query parameter to circumvent URI validation, while switching from "/ajax/" to "/wo/" endpoints bypasses payload sanitization routines. References: https://horizon3.ai/attack-research/cve-2025-40551-another-solarwinds-web-help-desk-deserialization-issue/ https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40551 https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm https://nvd.nist.gov/vuln/detail/CVE-2025-40551 Remediation: Update SolarWinds Web Help Desk to version 2026.1 or later.
url