CVE-2025-26399

Published Sep 23, 2025

Last updated 14 hours ago

CVSS critical 9.8

SolarWinds Web Help Desk

Supply chain

Overview

Description: SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
Source: psirt@solarwinds.com
NVD status: Modified
Products: web_help_desk

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@solarwinds.com: CWE-502

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 9

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "46BAB832-25B8-4ED6-B209-759F4B470CCE",
            "versionEndIncluding": "12.8.6",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:solarwinds:web_help_desk:12.8.7:-:*:*:*:*:*:*",
            "matchCriteriaId": "B88A115F-EDE4-447D-A35B-902A4074824A",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.