---
id: CVE-2025-26399
title: >-
  SolarWinds Web Help Desk was found to be susceptible to an unauthenticated
  AjaxProxy deserialization remote code execution vulnerability that, if
  exploited, would allow an attacker to run commands on the host machine
summary: >-
  SolarWinds Web Help Desk was found to be susceptible to an unauthenticated
  AjaxProxy deserialization remote code execution vulnerability that, if
  exploited, would allow an attacker to run commands on the host machine. This
  vulnerability …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-502
  - CWE-502
vendor: solarwinds
product: web_help_desk
affected:
  - web_help_desk <= 12.8.6
  - web_help_desk = 12.8.7
published: '2025-09-23'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T20:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-26399'
references:
  - url: >-
      https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm
    label: psirt@solarwinds.com
  - url: 'https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399'
    label: psirt@solarwinds.com
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
epss: 0.895
epssPercentile: 0.99785
kev: true
kevDateAdded: '2026-03-09'
kevDueDate: '2026-03-12'
kevRansomware: true
exploited: true
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/rxerium/CVE-2025-26399'
  nuclei:
    - CVE-2025-26399
  checkedAt: '2026-10-12T14:51:08.504Z'
exploitAvailable: true
ingestedAt: '2026-10-12T14:50:33.976Z'
---

## Overview

SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.

## Affected

- `web_help_desk <= 12.8.6`
- `web_help_desk = 12.8.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.