What’s Vulnerable › Vulnerabilities

CVE-2025-26399: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-03-09
• EPSS: 90.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-09-23 · updated 2026-10-11
• Weakness: CWE-502

Description

SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.

Affected products

• SolarWinds Web Help Desk: through 12.8.6; 12.8.7

References

• https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399
• https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/

Get alerted when CVE-2025-26399 or the next vulnerability affects your stack