CVE-2025-26399
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
Fix
Public exploits 1
- rxerium/CVE-2025-26399 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
CISA KEV required action · due 2026-03-12
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Added to the catalog 2026-03-09. CISA KEV
Patch, vendor advisory and mitigation references on NVD 1
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399 Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
In the news 1
Change history 1
- First seenCVSS 9.8 · in KEV · solarwindsNVD modified 2026-10-11 20:10
Affected (CPE criteria) 2
cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*cpe:2.3:a:solarwinds:web_help_desk:12.8.7:-:*:*:*:*:*:*
References 4
- https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm Release Notes
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399 Patch, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399 US Government Resource
- https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/ Third Party Advisory