← CVE Radar
CVE-2025-26399SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
9.8 CRITICALEPSS 90.56%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.8 | CRITICAL | 3.1SolarWinds (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due Mar 12, 2026
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2025-26399
- Status
- Analyzed
- Assigner (CNA)
- SolarWinds
- Published
- Sep 23, 2025
- Last modified
- 2026-10-11 20:10 UTC
- Weaknesses
- CWE-502 · Deserialization of Untrusted Data
Affected Products
As published by the CNA in the CVE record.
SolarWindsWeb Help Desk1 version range
- 12.8.7 and below
References
- documentation.solarwinds.com https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm
- solarwinds.com https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399
- microsoft.com https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/