CVE-2025-26399
SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
| CWE | CWE-502 |
| Vendor | solarwinds |
| Product | web help desk |
| Published | Sep 23, 2025 |
| Last Updated | Mar 10, 2026 |
⚠️ Actively Exploited — Act Now
Get instant alerts for solarwinds web help desk
This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2025-26399.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
SolarWinds / Web Help Desk
12.8.7 and below
References
solarwinds.com: https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399 documentation.solarwinds.com: https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm microsoft.com: https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/ cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399
Credits
🔍 Anonymous working with Trend Micro Zero Day Initiative