SolarWinds Web Help Desk Obfuscated JSON Bypass

Tim Peck@timpeck

•updated Mar 2, 2026•7•1•90

Detects HTTP POST requests to the SolarWinds Web Help Desk (WHD) AjaxProxy endpoint that contain hex-encoded JSON keys or values (e.g., `\xNN`). Attackers use this technique to bypass security filters and achieve remote code execution, as detailed in the exploit chain for CVE-2025-40552 and CVE-2025-40553.