Attackers abuse SolarWinds Web Help Desk to install Zoho agents and Velociraptor
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-26399 | Unauthenticated Deserialization RCE in SolarWinds Web Help Desk | 9.8 | 91% | KEVRansomware | KEV |
CVE-2025-40551+1 related CVE | Unauthenticated Deserialization RCE in SolarWinds Web Help Desk | 9.8 | 84% | KEV | KEV |
From the original article
2 min read at securityaffairs.com
Huntress confirmed active SolarWinds Web Help Desk exploits, where attackers installed Zoho tools for persistence, and used Velociraptor for control. On February 7, 2026, Huntress investigated an active attack abusing SolarWinds Web Help Desk flaws. Attackers exploited unpatched versions to run code remotely, then quickly installed Zoho ManageEngine tools for persistent remote access and Cloudflare tunnels.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.