Paper/Archive/CVE-2025-26399

CVE-2025-26399

SolarWinds Web Help Desk — SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability

KEV · due 12 Mar ransomware use EPSS 90%public exploit SSVC act CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 99.8.998 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.

Affected

ProductAffectedFixed inSource

Web Help Desk12.8.7 and below–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SolarWinds (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refsolarwinds.com/trust-center/security-advisories/CVE-2025-26399 refdocumentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm writeupmicrosoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399 kevcisa.gov/known-exploited-vulnerabilities-catalog