# CVE-2025-26399

SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.

- Page: https://www.vulneraibility.com/cve/CVE-2025-26399
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2026-03-09; CISA due date 2026-03-12; known ransomware use
- EPSS: 90.56%
- Unvetted proof-of-concept code on GitHub: 1 GitHub proof of concept · 1 Nuclei template (first 2025-09-23)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-09-23)
- Weakness: CWE-502
- Published: 2025-09-23

## Affected versions

- SolarWinds Web Help Desk: affected 12.8.7 and below

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399
- [other] https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm
- [advisory] https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.