Loading story…
SolarWinds issued another fix for Web Help Desk after attackers were found exploiting a patch bypass that left a previously addressed vulnerability still reachable. The report says the flaw was being actively exploited, forcing the company to reissue remediation guidance and update customers again to close the bypass condition.
The incident highlights the operational risk of incomplete vulnerability remediation, where an initial patch can be circumvented and exposed systems remain vulnerable despite prior updates. Organizations running Web Help Desk were urged to apply the latest vendor fix immediately and verify that earlier mitigations had not left the product exposed to continued exploitation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In its 2026 cyber claims report, Coalition said 86% of businesses in its analyzed 2025 claims data refused to pay ransomware demands. The report framed this as evidence of stronger resilience, including better backups and incident response planning.
Coalition's 2026 cyber claims report found that initial ransomware demands increased by 47% during 2025. The finding was based on analysis of roughly 1,400 high-signal insurance claims with realized financial loss.
SolarWinds released an additional fix for an actively exploited Web Help Desk vulnerability after a prior patch was found to be bypassable. The CSO Online report indicates the flaw was under active exploitation at the time of the renewed fix.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds released a security update for **Web Help Desk 2026.1 and all previous versions** to remediate **`CVE-2026-28299`**, a network-exploitable denial-of-service vulnerability. According to the vendor notice cited by EG-FinCIRT, the flaw has **low attack complexity** and can be triggered **without privileges or user interaction**, increasing the risk of opportunistic exploitation against exposed systems. Successful exploitation could exhaust memory, crash the Web Help Desk server, and disrupt service availability. Organizations using SolarWinds Web Help Desk were urged to validate and deploy the update as soon as testing is complete to reduce the risk of outages caused by unauthenticated attacks.
Jul 8, 2026
SolarWinds warned that multiple vulnerabilities in **Web Help Desk** are being actively exploited, with reporting highlighting a critical flaw that can lead to **remote code execution** on exposed help-desk servers. Public references tie the activity to `CVE-2025-40554`, while additional SolarWinds advisories and third-party research point to related issues including `CVE-2025-40552`, `CVE-2025-40553`, and `CVE-2025-40536`, indicating a broader security problem affecting the product. Security researchers and defenders published proof-of-concept material and detection guidance shortly after disclosure, including a watchTowr repository focused on Web Help Desk exploitation and a GitHub Gist describing **uncommon process activity** associated with compromise. The combination of vendor advisories, media reporting, and public exploit research indicates that attackers moved quickly to weaponize the flaws, increasing risk for organizations that have not patched, isolated, or monitored SolarWinds Web Help Desk deployments.
Jul 12, 2026
**CVE-2025-26399** is a **critical insecure deserialization** flaw (CWE-502) in *SolarWinds Web Help Desk* that enables **unauthenticated remote code execution/command execution** over the network. The issue resides in the product’s **`AjaxProxy`** component, where untrusted serialized data can be processed without sufficient validation, allowing an attacker to deliver a crafted payload that results in arbitrary command execution on the host running the help desk application. Multiple reports indicate the vulnerability is **actively exploited in the wild**, prompting **CISA** to add CVE-2025-26399 to the **Known Exploited Vulnerabilities (KEV)** catalog. NetSPI notes the flaw was disclosed in 2025 and is described as a **patch bypass** related to earlier issues (**CVE-2024-28988** and **CVE-2024-28986**), and recommends immediate remediation by upgrading to **SolarWinds Web Help Desk 12.8.7 Hotfix 1 or later**; if patching is delayed, organizations should restrict network exposure of the server and increase monitoring for suspicious process execution and outbound connections.
Jun 29, 2026