Critical severity9.8CISA KEVNVD Advisory· Published Sep 23, 2025· Updated Jun 17, 2026
CVE-2025-26399
CVE-2025-26399
Description
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*range: <=12.8.6
- cpe:2.3:a:solarwinds:web_help_desk:12.8.7:-:*:*:*:*:*:*
- (no CPE)range: 12.8.7 and below
Patches
Vulnerability mechanics
References
4- www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399nvdPatchVendor Advisory
- www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/nvdThird Party Advisory
- documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htmnvdRelease Notes
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
4- Adriatic Port Cyber-Attack by Anubis Sparks Warning Over Maritime Security RisksInfosecurity Magazine · Jun 15, 2026
- 16th March – Threat Intelligence ReportCheck Point Research · Mar 16, 2026
- Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s))watchTowr Labs · Feb 25, 2026
- Risky Business #824 -- Microsoft's Secure Future is looking a bit wobblyRisky Business · Feb 11, 2026