PT-2025-39120 · Solarwinds · Solarwinds Web Help Desk

Published 2025-09-17 · Updated 2026-04-21 · CVE-2025-26399

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk versions prior to 2026.1

Description An unauthenticated remote code execution flaw exists in the 'AjaxProxy' component of SolarWinds Web Help Desk. The issue is caused by the deserialization of untrusted data, where attacker-controlled Java objects are processed without proper validation. This allows a remote attacker to send crafted POST requests to the 'AjaxProxy' endpoint to execute arbitrary commands on the host machine with service account privileges. This issue represents a bypass of two previous patch attempts. Real-world exploitation has been observed, including use by the Warlock ransomware group and the GOLD ENCOUNTER group, often involving lateral movement across networks and the deployment of ransomware or mining rigs.

Recommendations Update to version 2026.1. Update to version 12.8.7 Hotfix 1. Disable internet-facing access and restrict the software to VPN or internal networks. Restrict access to the 'AjaxProxy' component to minimize the risk of exploitation.

Fix

RCE

LPE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-11514

CVE-2025-26399

ZDI-25-906

Affected Products

Solarwinds Web Help Desk

References · 177

• https://zerodayinitiative.com/advisories/ZDI-25-906 · Security Note
• https://osv.dev/vulnerability/CVE-2025-26399 · Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm · Security Note
• https://microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk · Vendor Advisory
• https://solarwinds.com/trust-center/security-advisories/CVE-2025-26399 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-26399 · Security Note
• https://solarwinds.com/trust-center/security-advisories/cve-2025-26399 · Security Note
• https://bdu.fstec.ru/vul/2025-11514 · Security Note
• https://twitter.com/ScyScan/status/1970495887211409538 · Twitter Post
• https://twitter.com/DeusLogica/status/2033226724935078236 · Twitter Post
• https://twitter.com/zeeshankghouri/status/1970689986728284543 · Twitter Post
• https://twitter.com/helpnetsecurity/status/1970843507247157284 · Twitter Post
• https://twitter.com/TheZDIBugs/status/1970894680125571582 · Twitter Post
• https://twitter.com/securityRSS/status/1970602380577095731 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1nq2t24/top_10_trending_cves_25092025 · Reddit Post