As cited
Copy frozen at (site build).
SolarWinds Web Help Desk Exploitation - February 2026
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
SolarWinds Web Help Desk Exploitation - February 2026
Microsoft reported active exploitation of SolarWinds Web Help Desk servers beginning in February 2026, leveraging one of three recently disclosed remote code execution vulnerabilities (CVE-2025-26399, CVE-2025-40536, or CVE-2025-40551). Threat actors established persistent access through remote monitoring and management software, credential dumping via DCSync and NTDS.dit extraction, and tunneling mechanisms including QEMU virtual systems and Cloudflare tunnels. The campaign employed living-off-the-land techniques, including abuse of legitimate tools like Velociraptor and security control bypass to disable Windows Defender and Firewall.
Why it matters: Organizations running unpatched SolarWinds Web Help Desk 12.8.8 HF1 or earlier face immediate risk of unauthenticated remote code execution and full domain compromise; apply patches and rotate all associated credentials today.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
SolarWinds Web Help Desk Exploitation - February 2026
Microsoft reported active exploitation of SolarWinds Web Help Desk servers beginning in February 2026, leveraging one of three recently disclosed remote code execution vulnerabilities (CVE-2025-26399, CVE-2025-40536, or CVE-2025-40551). Threat actors established persistent access through remote monitoring and management software, credential dumping via DCSync and NTDS.dit extraction, and tunneling mechanisms including QEMU virtual systems and Cloudflare tunnels. The campaign employed living-off-the-land techniques, including abuse of legitimate tools like Velociraptor and security control bypass to disable Windows Defender and Firewall.
Why it matters: Organizations running unpatched SolarWinds Web Help Desk 12.8.8 HF1 or earlier face immediate risk of unauthenticated remote code execution and full domain compromise; apply patches and rotate all associated credentials today.
- Source published
- First seen by Cybersecurity Tracker