PT-2025-39120 · Solarwinds · Solarwinds Web Help Desk

Published 2025-09-17 · Updated 2026-03-15 · CVE-2025-26399

Positive Technologies · (AI Summary)

CVSS v2.0

10

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk versions prior to 12.8.7 Hotfix 1 SolarWinds Web Help Desk versions 12.8.3 and earlier SolarWinds Web Help Desk version 2026.1

Description SolarWinds Web Help Desk is affected by a critical remote code execution (RCE) vulnerability (CVE-2025-26399) stemming from a deserialization of untrusted data flaw within the AjaxProxy component. This vulnerability allows unauthenticated attackers to execute arbitrary commands on affected systems. The vulnerability has been actively exploited in the wild, with threat actors utilizing various tools and techniques. Multiple attempts have been made to patch this vulnerability, but previous fixes have been bypassed. The vulnerability allows attackers to gain full host compromise, potentially leading to data exposure, lateral movement, and service disruption. The vulnerability is actively being exploited and poses a significant risk to organizations using vulnerable versions of SolarWinds Web Help Desk.

Recommendations SolarWinds Web Help Desk versions prior to 12.8.7 Hotfix 1: Upgrade to version 12.8.7 Hotfix 1 immediately. SolarWinds Web Help Desk versions 12.8.3 and earlier: Upgrade to version 2026.1. SolarWinds Web Help Desk version 12.8.7: Upgrade to version 2026.1.

Fix

LPE

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-11514

CVE-2025-26399

ZDI-25-906

Affected Products

Solarwinds Web Help Desk

References · 162

• https://solarwinds.com/trust-center/security-advisories/cve-2025-26399 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-906 · Security Note
• https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm · Security Note
• https://osv.dev/vulnerability/CVE-2025-26399 · Vendor Advisory
• https://solarwinds.com/trust-center/security-advisories/CVE-2025-26399 · Vendor Advisory
• https://microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11514 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-26399 · Security Note
• https://twitter.com/ABabino/status/1970491293345239465 · Twitter Post
• https://twitter.com/AdliceSoftware/status/1970521048819945731 · Twitter Post
• https://twitter.com/TheCySecNews/status/1970477743000154501 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1970582969241760097 · Twitter Post
• https://t.me/ZerodayAlert/634 · Telegram Post
• https://twitter.com/IT_news_for_all/status/1970470392989892631 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1970497376671445110 · Twitter Post