CVE-2025-26399

SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

90% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-25)

CISA KEV

listed 2026-03-09, due 2026-03-12, known ransomware use

CWE

CWE-502

Published

2025-09-23

Modified

2026-10-11

Record from

the NVD, synced 2026-10-19

Affected

• solarwinds:web_help_desk

References

• https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399
• https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/

Check your stackJSON