CVE-2025-26399
Critical 9.8 Exploited in the wild (KEV) Used in ransomware campaigns
Confirmed active exploitation — CISA KEV catalog
- Name
- SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
Metrics
- CVSS 3.1
-
9.8 (CRITICAL)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 91% (percentile: 100) as of 1 November 2026
- CWE
- CWE-502
Affected products
solarwinds: web help desk
References
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399 PatchVendor Advisory
- https://documentation.solarwinds.com/en/success_center/whd/content/release_note… Release Notes
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025… US Government Resource
- https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-so… Third Party Advisory