CVE-2025-26399: SolarWinds Web Help Desk unauthenticated deserialization RCE (patch-bypass)
The short version: SolarWinds Web Help Desk has an unauthenticated deserialization flaw in its AjaxProxy component (CVE-2025-26399) that lets an attacker run commands on the host. It's a patch bypass of CVE-2024-28988, which was itself a patch bypass of CVE-2024-28986 — the same weakness reopened twice. It's in CISA's KEV catalog. If you run Web Help Desk, patch and verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (see below) |
| CVSS v3.1 (NVD) | Unknown at time of writing — NVD record awaiting analysis |
| CVSS (SolarWinds, CNA) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 88.33% · 99.75th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2026-03-12 |
| Known exploited? | Yes — listed as a known-exploited vulnerability |
| Vulnerability type | CWE-502 deserialization of untrusted data (AjaxProxy) → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Lineage | Patch bypass of CVE-2024-28988 (itself a bypass of CVE-2024-28986) |
| Affected | SolarWinds Web Help Desk 12.8.7 and below |
| Fixed in | Web Help Desk 12.8.7 Hotfix 1 |
What you need to know
The flaw is unsafe deserialization in the AjaxProxy component. An unauthenticated attacker sends crafted serialized data that the application deserializes into attacker-controlled objects, yielding command execution on the host.
- It's pre-authentication and ends in RCE — the worst combination for an internet-facing service.
- It's a repeat. This is the third disclosed turn of the same underlying weakness (CVE-2024-28986 → CVE-2024-28988 → this one). A patch-bypass lineage signals a stubborn root cause and attacker attention.
- It's automatable and in KEV, which is why EPSS sits near the top.
How serious we see it
High — and the practical case is unambiguous.
Unauthenticated remote code execution on a help-desk server that often sits at the edge, confirmed in KEV, with a patch-bypass history, is textbook top-of-queue. One note on accuracy: NVD hasn't published its own score yet, so the CVSS above is SolarWinds' as the CNA — but nothing about the missing NVD row softens the picture. The bounded, reassuring part is that it's specific and fixed: a defined version line and a published hotfix. Given the patch-bypass lineage, apply the current fix rather than an older partial one, and verify.
Recommendations
Straight from SolarWinds' advisory and CISA:
- Patch now. Apply Web Help Desk 12.8.7 Hotfix 1 (or the current fixed release) — not an earlier partial patch from the same lineage.
- Restrict exposure. Keep Web Help Desk off the open internet where possible; limit to trusted networks or a VPN.
- Hunt. Given in-the-wild use, review for anomalous processes, outbound connections, and web-shell artifacts on the host.
- If compromised, respond fully. Rebuild where warranted and rotate credentials, keys, and secrets reachable from the host.
- Confirm your exposure first. Verify whether you run an internet-facing Web Help Desk and which version.
How BreachRisk sees it
BreachRisk works this from the outside in. From little more than your domain it discovers internet-facing SolarWinds Web Help Desk, fingerprints the version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one, surfaced at the top because it's in KEV. We identify and flag the affected version; we don't exploit it. The continuous, attacker's-eye view means an exposed, unpatched Web Help Desk is already mapped when an unauthenticated RCE lands.