Loading story…
SolarWinds released Web Help Desk 12.8.7 Hotfix 1 to fix CVE-2025-26399, a critical unauthenticated remote code execution flaw affecting versions earlier than the hotfix. The vulnerability stems from unsafe deserialization in the AjaxProxy component and can allow a remote attacker to run commands and potentially take full control of an exposed system. SolarWinds published release notes for the hotfix and updated installation and upgrade guidance to support remediation.
The flaw was reported as a bypass of earlier incomplete fixes tied to CVE-2024-28988 and CVE-2024-28986, making it the third update in the patch sequence for the same attack surface. CSIRT.SK urged administrators to upgrade immediately to 12.8.7 Hotfix 1, noting that CVE-2024-28986 had already been added to CISA's Known Exploited Vulnerabilities catalog, underscoring the risk to organizations still running vulnerable Web Help Desk deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK reported that CVE-2025-26399 bypasses an insufficient patch for CVE-2024-28988, which itself had addressed an insufficient patch for CVE-2024-28986. The article urged administrators to upgrade urgently to Web Help Desk 12.8.7 Hotfix 1.
The CSIRT.SK article states that CISA added CVE-2024-28986 to its Known Exploited Vulnerabilities catalog in August 2024, indicating the flaw was known to be exploited in the wild.
SolarWinds released Web Help Desk 12.8.7 Hotfix 1 to fix critical unauthenticated remote code execution vulnerability CVE-2025-26399. The flaw affects versions earlier than 12.8.7 Hotfix 1 and is described as unsafe deserialization in the AjaxProxy component.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
documentation.solarwinds.com
Open sourcecsirt.sk
Open sourcedocumentation.solarwinds.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2025-26399** is a **critical insecure deserialization** flaw (CWE-502) in *SolarWinds Web Help Desk* that enables **unauthenticated remote code execution/command execution** over the network. The issue resides in the product’s **`AjaxProxy`** component, where untrusted serialized data can be processed without sufficient validation, allowing an attacker to deliver a crafted payload that results in arbitrary command execution on the host running the help desk application. Multiple reports indicate the vulnerability is **actively exploited in the wild**, prompting **CISA** to add CVE-2025-26399 to the **Known Exploited Vulnerabilities (KEV)** catalog. NetSPI notes the flaw was disclosed in 2025 and is described as a **patch bypass** related to earlier issues (**CVE-2024-28988** and **CVE-2024-28986**), and recommends immediate remediation by upgrading to **SolarWinds Web Help Desk 12.8.7 Hotfix 1 or later**; if patching is delayed, organizations should restrict network exposure of the server and increase monitoring for suspicious process execution and outbound connections.
Jun 29, 2026
SolarWinds released security updates for **Web Help Desk (WHD)** to address two critical vulnerabilities affecting versions **12.4 through 12.8**. One issue, **`CVE-2024-28986`**, is a Java deserialization flaw that can lead to **remote code execution** and carries a **CVSS 9.8** rating; public reporting said the vulnerability was **actively exploited**. A second critical issue, tracked in SolarWinds advisories as **`CVE-2024-28987`**, involves **built-in accounts with default passwords** that could let attackers gain unauthorized remote access and modify data. SolarWinds advised customers to **upgrade to WHD 12.8.3** and apply **Hotfix 1** and **Hotfix 2**, with backups taken before installing the fixes. The vendor published a trust-center advisory for `CVE-2024-28987`, while external incident reporting highlighted the urgency of patching because the flaws could allow both full compromise of vulnerable servers and abuse of default credentials in exposed deployments.
Jul 24, 2026
SolarWinds released a security update for **Web Help Desk 2026.1 and all previous versions** to remediate **`CVE-2026-28299`**, a network-exploitable denial-of-service vulnerability. According to the vendor notice cited by EG-FinCIRT, the flaw has **low attack complexity** and can be triggered **without privileges or user interaction**, increasing the risk of opportunistic exploitation against exposed systems. Successful exploitation could exhaust memory, crash the Web Help Desk server, and disrupt service availability. Organizations using SolarWinds Web Help Desk were urged to validate and deploy the update as soon as testing is complete to reduce the risk of outages caused by unauthenticated attacks.
Jul 8, 2026