CVE-2025-40551

What it actually does

The vulnerability is an unauthenticated remote code execution flaw caused by unsafe deserialization of untrusted data. A network-accessible attacker can send a crafted serialized payload to the vulnerable service, causing the application to instantiate attacker-controlled objects and execute commands on the underlying host with the privileges of the application service account. Because the CVSS vector is network-accessible, low-complexity, requires no privileges, and requires no user interaction, successful exploitation can compromise confidentiality, integrity, and availability of the affected system. The supplied fixed package information indicates kube-state-metrics in MinimOS is remediated in version 2.17.0-r4.

Why it matters to the business

Successful exploitation can give an attacker control of the affected host, enabling data theft, service disruption, lateral movement, malware deployment, or use of the server as an entry point into broader infrastructure. The vulnerability is listed in CISA KEV, has active exploitation in the wild, and has a high EPSS score, so internet-exposed or broadly reachable instances should be treated as urgent remediation targets. CISA's listed remediation deadline is 2026-02-06; organizations subject to KEV-driven remediation requirements should prioritize closure accordingly.

How an attack unfolds

An attacker first identifies an exposed vulnerable service and confirms it accepts the affected unauthenticated request path or data format. The attacker then sends a specially crafted serialized object payload designed to trigger unsafe deserialization in the application. When the vulnerable component processes the payload, the object graph invokes code paths that execute attacker-controlled commands on the host. After initial command execution, the attacker may stage additional tooling, create a web shell or persistence mechanism, dump configuration and credentials available to the service account, enumerate adjacent systems, and pivot deeper into the environment. Because exploitation is unauthenticated and active in the wild, opportunistic scanning and automated exploitation should be expected.

How to fix it

Upgrade affected deployments to a fixed version immediately. For the supplied affected package, update kube-state-metrics in MinimOS to 2.17.0-r4 or later. If the vulnerable SolarWinds Web Help Desk component is present in the environment, apply the vendor-provided fixed release or hotfix for the affected product line. If immediate patching is not possible, restrict network access to the service, remove internet exposure, place the service behind a VPN or allowlist, block unauthenticated access paths where feasible, disable vulnerable functionality if a vendor-supported mitigation exists, and monitor aggressively for exploitation attempts. Rotate credentials and secrets accessible to the application if compromise is suspected. Rebuild affected hosts or containers from trusted images if there is evidence of successful remote code execution.

How to confirm the fix worked

Confirm the installed package or product version is at or above the fixed version, including downstream packages and container images. For the supplied package, verify kube-state-metrics reports or is packaged as 2.17.0-r4 or later in MinimOS. Confirm that vulnerability scanners, software composition analysis tools, and package inventory systems no longer report the vulnerable version. Validate that internet-facing exposure has been removed or restricted where required. Review reverse proxy, WAF, application, and host logs around the exposure window for deserialization errors, suspicious unauthenticated requests, abnormal child processes spawned by the application runtime, unexpected file writes, and outbound connections from the application host. Where feasible, perform an authenticated configuration review and a non-destructive validation scan rather than sending exploit payloads to production systems.

Typical attack path

1. Scan the internet or internal address space for exposed instances of the affected service or vulnerable package.
2. Send probe requests that test whether serialized data is accepted and processed by the target application.
3. Deliver a crafted deserialization payload to the vulnerable unauthenticated endpoint or service interface.
4. Achieve command execution under the privileges of the application or container process.
5. Run discovery commands to identify the operating system, user context, network interfaces, secrets, and reachable internal services.
6. Download or execute second-stage tooling such as a web shell, reverse shell, credential dumper, bot, or remote access tool.
7. Establish persistence or modify application files, scheduled tasks, services, startup scripts, or container images.
8. Use harvested credentials or network reachability to move laterally and access sensitive systems or data.

How to detect it

Investigate whether exposed instances received suspicious unauthenticated requests containing serialized-object data or whether the application produced deserialization-related errors before unexpected command execution. Review web server, reverse proxy, WAF, load balancer, application, container, EDR, shell history, process creation, DNS, and outbound network logs. Focus on requests with Java serialization magic bytes, unusual binary payloads, abnormal content types, large POST bodies, repeated 4xx/5xx responses followed by successful responses, and requests from scanners or unfamiliar IP addresses. On hosts, look for child processes spawned by the application runtime such as shells, PowerShell, cmd.exe, curl, wget, certutil, bash, sh, python, perl, nc, or busybox. Review file integrity and recent modifications in application directories, temporary directories, web roots, startup locations, cron directories, systemd unit paths, and container writable layers. Search for newly created web shells, unexpected archives, reverse-shell tooling, renamed binaries, suspicious scheduled tasks, new local users, altered SSH authorized_keys files, and outbound connections to unrecognized infrastructure. Because active exploitation is reported, hunt across the entire period the vulnerable version was reachable, not only after public disclosure.

• AC ED 00 05
• Content-Type: application/x-java-serialized-object
• java.io.InvalidClassException
• java.io.StreamCorruptedException
• invalid stream header
• cannot be cast to java.io.Serializable
• java.lang.RuntimeException: InvocationTargetException
• java.lang.ProcessBuilder
• Runtime.getRuntime().exec
• /bin/sh -c
• /bin/bash -c
• cmd.exe /c
• powershell.exe -enc
• powershell -EncodedCommand
• curl http://
• wget http://
• certutil.exe -urlcache
• nc -e
• ncat -e
• busybox wget
• /tmp/.java
• /tmp/.tmp
• /var/tmp/.java
• .jsp?cmd=
• cmd.jsp
• shell.jsp
• /etc/cron.d/
• /var/spool/cron/
• /root/.ssh/authorized_keys
• C:\Windows\Temp\
• C:\ProgramData\
• java.exe spawning cmd.exe
• java.exe spawning powershell.exe
• java spawning /bin/sh
• tomcat spawning /bin/sh

What your security team should do

• Treat this as a priority-one remediation item for any exposed instance because it is KEV-listed, unauthenticated, remotely exploitable, high severity, and actively exploited in the wild.
• Inventory all deployments of the affected software, including appliances, containers, downstream packages, and images that may include the vulnerable component.
• Upgrade kube-state-metrics in MinimOS to 2.17.0-r4 or later, and apply the relevant vendor fix for any SolarWinds Web Help Desk deployments that match the vulnerable product line.
• Immediately remove public exposure or restrict access to trusted administrative networks until patching is complete.
• Hunt for prior exploitation across the full exposure window, especially since the issue is already exploited in the wild and has a high EPSS score.
• Review application service accounts, local credentials, API keys, database credentials, and secrets accessible from the affected host; rotate them if suspicious activity is found.
• Look for suspicious child processes spawned by Java, Tomcat, web application, container, or service processes.
• If compromise is confirmed, isolate affected hosts, preserve forensic evidence, rebuild from trusted media or images, and perform credential rotation and lateral movement investigation.
• Add SIEM detections for Java serialization magic bytes in HTTP traffic, deserialization exceptions, abnormal application-spawned shells, and unexpected outbound connections from affected servers.
• Track CISA KEV remediation obligations and ensure completion before the listed 2026-02-06 due date where applicable.