Active Exploitation of SolarWinds Web Help Desk Insecure Deserialization (CVE-2025-26399)
Active Exploitation · 2 sources · Updated 4mo ago · First seen Mar 12, 2026
CVE-2025-26399 is a critical insecure deserialization flaw (CWE-502) in SolarWinds Web Help Desk that enables unauthenticated remote code execution/command execution over the network. The issue resides in the product’s AjaxProxy component, where untrusted serialized data can be processed without sufficient validation, allowing an attacker to deliver a crafted payload that results in arbitrary command execution on the host running the help desk application.
Multiple reports indicate the vulnerability is actively exploited in the wild, prompting CISA to add CVE-2025-26399 to the Known Exploited Vulnerabilities (KEV) catalog. NetSPI notes the flaw was disclosed in 2025 and is described as a patch bypass related to earlier issues (CVE-2024-28988 and CVE-2024-28986), and recommends immediate remediation by upgrading to SolarWinds Web Help Desk 12.8.7 Hotfix 1 or later; if patching is delayed, organizations should restrict network exposure of the server and increase monitoring for suspicious process execution and outbound connections.
