Preliminary research

Buy A Help Desk, Bundle A Remote Access Solution? SolarWinds Web Help Desk Pre-Auth RCE Chains

@chudyPB and Piotr Bazydlo (@chudyPB) · watchTowr Labs · 25 February 2026

AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Patch-diffs SolarWinds Web Help Desk to recover a deserialization patch bypass, two authentication bypasses and a SQL-query gadget. Combining the flaws produces a pre-authentication Java deserialization path to remote code execution and supplies detection artifacts.

Record

Researcher

@chudyPB and Piotr Bazydlo (@chudyPB)

Published by

watchTowr Labs

Date

25 February 2026

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• java
• deserialization
• patch-bypass
• auth-bypass
• sqli
• attack-chain
• rce
• owasp-a01-2021
• owasp-a03-2021
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of @chudyPB and Piotr Bazydlo (@chudyPB), first published at the original source. Preserved copies are kept so the citation survives its host.