CVE-2025-26399

Published Sep 23, 2025

Last updated 2 months ago

Exploit known CVSS critical 9.8

Zero-day

SolarWinds Web Help Desk

Server

Rdp

Supply chain

web application

Overview

Description: SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
Source: psirt@solarwinds.com
NVD status: Analyzed
Products: web_help_desk

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
Exploit added on: Mar 9, 2026
Exploit action due: Mar 12, 2026
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weaknesses

psirt@solarwinds.com: CWE-502
nvd@nist.gov: CWE-502

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "46BAB832-25B8-4ED6-B209-759F4B470CCE",
            "versionEndIncluding": "12.8.6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:solarwinds:web_help_desk:12.8.7:-:*:*:*:*:*:*",
            "matchCriteriaId": "B88A115F-EDE4-447D-A35B-902A4074824A",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Known exploits

Weaknesses

Social media

Configurations

Related CVEs

References