CVE DatabaseCVE-2025-26399

Updated 2026-10-11한국어 권고문 →

CVE-2025-263999.8/CRITICALCISA KEVCWE-502CWE-502

SolarWinds Web Help Desk AjaxProxy Deserialization Remote Code Execution Vulnerability (CVE-2025-26399, CISA KEV)

⚡ Jump to Patch

Affected Vendors

solarwinds

Affected Components

web help desk

Published Date

2025-09-23

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

90.6%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

SolarWinds Web Help Desk (WHD) versions 12.8.3 Hotfix 3 and prior

Impact

Unauthenticated remote attackers can execute arbitrary commands with system privileges on the host machine by sending specially crafted serialized data

Mitigation

Immediately upgrade to SolarWinds Web Help Desk 12.8.7 Hotfix 1 or later as recommended by the vendor advisory

Affected Products & Version Scope

SolarWinds Web Help Desk (WHD) versions 12.8.3 Hotfix 3 and earlier (including environments with CVE-2024-28986/28988 patches applied)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the official hotfix provided by SolarWinds immediately. Below is an example of stopping the service, downloading the patch, and applying it on a Linux host.

bash

# Stop the Web Help Desk service
sudo service webhelpdesk stop

# Download the secure version (12.8.7 Hotfix 1 or later)
# (Please use your official SolarWinds Customer Portal link to fetch the package)
wget https://downloads.solarwinds.com/solarwinds/Release/HotFix/WHD-12.8.7-Hotfix1.zip
unzip WHD-12.8.7-Hotfix1.zip

# Apply the patch files and restart the service
sudo service webhelpdesk start

2. Temporary Workaround & Hardening Configuration

If patching cannot be performed immediately, restrict external access to the vulnerable AjaxProxy endpoints using a reverse proxy such as Nginx.

nginx

# Nginx configuration block (/etc/nginx/conf.d/whd.conf)
server {
    listen 80;
    server_name whd.internal.local;

    # Block external access to AjaxProxy endpoints
    location ~* /(.*)AjaxProxy(.*) {
        allow 10.0.0.0/8; # Allow trusted internal IP range only
        deny all;
    }

    location / {
        proxy_pass http://127.0.0.1:8081;
    }
}

3. Log Audit & IoC Verification Commands

Inspect application logs to identify potential exploitation attempts targeting the AjaxProxy endpoint.

bash

# Search for suspicious AjaxProxy requests in WHD logs
grep -i 'AjaxProxy' /usr/local/webhelpdesk/log/*.log

# Verify the running process and its privilege level
ps -ef | grep -i webhelpdesk

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Due to active exploitation in the wild, immediately upgrade SolarWinds Web Help Desk to version 12.8.7 Hotfix 1 or later to mitigate the risk.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-26399) is an unauthenticated deserialization vulnerability (CWE-502) residing in the AjaxProxy component of SolarWinds Web Help Desk (WHD). It has been identified as a patch bypass of previous vulnerabilities CVE-2024-28986 and CVE-2024-28988. The root cause lies in the application's failure to properly validate user-supplied serialized objects before deserializing them, allowing arbitrary object injection.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker can target the exposed AjaxProxy endpoint without any credentials. By sending a malicious payload containing a Java deserialization gadget chain via HTTP requests, the attacker forces the application to deserialize the untrusted data. During the deserialization process, the payload triggers arbitrary code execution under the security context of the Web Help Desk process (typically SYSTEM or Administrator).

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical), this vulnerability poses an extreme risk and is actively exploited in the wild, leading to its inclusion in the CISA KEV catalog. Successful exploitation grants full administrative control over the help desk server, enabling attackers to pivot into internal networks, exfiltrate sensitive customer support tickets, and compromise corporate credentials.

Official Vendor Advisories & References

NVD Original English Description

SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.

https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm

Source: psirt@solarwinds.com · Release Notes

https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399

Source: psirt@solarwinds.com · Patch, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Third Party Advisory

Frequently Asked SecOps Questions (CVE-2025-26399)

FAQ

Q1. How critical is CVE-2025-26399 and is it actively exploited in the wild?

CVE-2025-26399 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 90.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2025-26399?

Primary impacted vendors include solarwinds across web help desk. Scope summary: SolarWinds Web Help Desk (WHD) versions 12.8.3 Hotfix 3 and earlier (including environments with CVE-2024-28986/28988 patches applied)

Q3. What temporary mitigations or workarounds exist for CVE-2025-26399 before patching?

[Mitigation] Immediately upgrade to SolarWinds Web Help Desk 12.8.7 Hotfix 1 or later as recommended by the vendor advisory Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION