Actively exploited · Published Sep 23, 2025 · Assigned by SolarWinds
CVE-2025-26399SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity unsafe deserialization in Web Help Desk from SolarWinds. Attackers are actively exploiting it in the wild (listed by CISA on March 9, 2026). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 90.6% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Mar 12, 2026.
Official description
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SolarWinds | Web Help Desk | 12.8.7 and below |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399
- https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm
- https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/ third-party-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399 government-resource