CVE-2025-26399
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
Description
CVE-2025-26399 is a CRITICAL unauthenticated remote code execution vulnerability in SolarWinds Web Help Desk, carrying a CVSS 3.1 score of 9.8. The vulnerability exists in the AjaxProxy component and stems from insecure deserialization, allowing an unauthenticated remote attacker to execute arbitrary code on the server. Notably, this vulnerability is a patch bypass for CVE-2024-28988, which itself was a bypass of CVE-2024-28986, indicating a persistent deserialization attack surface in this component. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2026-03-09 with a remediation deadline of 2026-03-12. With an EPSS score of 0.288 (28.8%), combined with the critical severity and unauthenticated attack vector, this vulnerability demands the highest priority for remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| solarwinds | web help desk | <= 12.8.6; 12.8.7 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm(Release Notes)
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399(US Government Resource)
- https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/(Third Party Advisory)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2025-26399 is classified under CWE-502 — Deserialization of Untrusted Data. Deserialization vulnerabilities occur when an application reconstructs objects from serialized data without adequately verifying the integrity and safety of that data. When untrusted input is deserialized, an attacker can craft malicious serialized payloads that, upon deserialization, instantiate dangerous object types, trigger method calls, and ultimately achieve arbitrary code execution on the server.
In the context of SolarWinds Web Help Desk, this weakness is extremely concerning for several reasons. First, the vulnerability is in the AjaxProxy component and is accessible without authentication, meaning any network-reachable attacker can trigger deserialization of malicious payloads. Second, this is the third iteration of essentially the same vulnerability — CVE-2024-28986 was the original finding, CVE-2024-28988 was a patch bypass, and CVE-2025-26399 bypasses the fix for CVE-2024-28988. This pattern of repeated bypasses suggests fundamental architectural issues with how the AjaxProxy component handles serialized data, rather than isolated implementation bugs. Java deserialization vulnerabilities, which commonly underlie such flaws, have well-established exploitation techniques using gadget chains from common libraries.
Impact Analysis
CVE-2025-26399 carries a CVSS 3.1 score of 9.8 (CRITICAL) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Confidentiality (HIGH): Successful exploitation grants an attacker full access to the Web Help Desk server, including its database containing support tickets, user credentials, configuration data, and potentially sensitive information submitted through help desk tickets. The server's file system, environment variables, and any accessible network resources are also exposed.
Integrity (HIGH): Arbitrary code execution allows the attacker to modify any data on the server, install backdoors, alter help desk records, tamper with user accounts, and deploy persistent access mechanisms. The attacker can also modify the application itself to intercept future sensitive data.
Availability (HIGH): Full control over the server enables the attacker to shut down the Web Help Desk service, encrypt or destroy data, or consume system resources. Given that Web Help Desk is an IT service management tool, its disruption can cascade into broader IT operations impact.
The combination of unauthenticated access, network attack vector, low complexity, and maximum impact across all three CIA triad dimensions results in the near-maximum CVSS score of 9.8. The extremely tight KEV remediation deadline of just 3 days (2026-03-09 to 2026-03-12) further underscores the urgency.
Exploit Maturity
CVE-2025-26399 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog as of 2026-03-09.
Exploit status: This vulnerability is actively exploited, and the extremely short KEV remediation deadline (3 days) indicates CISA assessed the threat as imminent. The predecessor vulnerabilities (CVE-2024-28986 and CVE-2024-28988) had well-documented exploitation, and the bypass nature of CVE-2025-26399 means existing exploit tooling could be adapted with minimal effort. Java deserialization exploits benefit from mature tooling such as ysoserial and similar gadget chain generators.
Ransomware association: SolarWinds Web Help Desk has been a repeated target for threat actors. Deserialization RCE vulnerabilities in internet-facing IT management tools are prime targets for ransomware operators, as they provide immediate privileged access to infrastructure that is central to IT operations.
Attack surface: Any internet-facing SolarWinds Web Help Desk instance running a vulnerable version is at risk. The unauthenticated nature means no credentials are needed, and the AjaxProxy endpoint is accessible by default. The history of repeated patch bypasses means that organizations who applied previous fixes but not the latest patch remain vulnerable.
KEV deadline: CISA set an unusually aggressive remediation deadline of 2026-03-12, just 3 days after the KEV listing date of 2026-03-09. This compressed timeline signals active, widespread exploitation requiring emergency response.
Remediation
- Apply the latest SolarWinds Web Help Desk patch immediately. This is an emergency-priority update. Given the unauthenticated RCE nature and the extremely short KEV deadline, this patch should be treated as a break-fix deployment. Verify that the patch specifically addresses CVE-2025-26399 and not only the earlier CVE-2024-28988.
- Verify your patch level covers all three related CVEs. Due to the chain of patch bypasses (CVE-2024-28986, CVE-2024-28988, CVE-2025-26399), ensure your installed version addresses the latest bypass. Previous patches are insufficient.
- Restrict network access to Web Help Desk. If not already implemented, immediately restrict access to the Web Help Desk application from the public internet. Place it behind a VPN, firewall, or reverse proxy with IP allowlisting. The AjaxProxy endpoint should not be accessible to unauthenticated external users.
- Conduct immediate compromise assessment. Given confirmed active exploitation and the unauthenticated nature, assume potential compromise until verified otherwise. Check for unauthorized processes, unexpected network connections, new or modified files, and suspicious entries in application and system logs.
- Rotate all credentials on and accessible from the server. This includes database credentials, service account passwords, API keys, and any credentials stored in the Web Help Desk application or its configuration files. Also consider credentials that may have been submitted through help desk tickets.
- Implement application-level monitoring. Deploy enhanced logging and monitoring on the Web Help Desk server, focusing on the AjaxProxy endpoint, deserialization activity, unusual process creation, and outbound network connections.
Technical Details
CVE-2025-26399 is a CRITICAL unauthenticated deserialization remote code execution vulnerability in SolarWinds Web Help Desk. The vulnerability is remotely exploitable over the network with low attack complexity. No authentication or user interaction is required.
Technical mechanism: The AjaxProxy component in SolarWinds Web Help Desk processes serialized Java objects from incoming HTTP requests without sufficient validation. An attacker can craft a malicious serialized payload containing a gadget chain — a sequence of existing Java class method invocations that, when triggered during deserialization, ultimately execute attacker-controlled commands. This is the third instance of this fundamental issue: CVE-2024-28986 was the original discovery, CVE-2024-28988 bypassed the initial fix (likely by using alternative gadget chains or serialization entry points), and CVE-2025-26399 bypasses the second fix. The repeated bypass pattern suggests that the fixes addressed specific gadget chains or payload signatures rather than eliminating the root cause of untrusted deserialization in the AjaxProxy.
CVSS 3.1 vector analysis (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): The Network attack vector confirms the AjaxProxy endpoint is remotely accessible. Low complexity indicates reliable exploitation. No privileges or user interaction are required — the endpoint accepts unauthenticated requests. The Unchanged scope means impact is within the Web Help Desk server boundary, though in practice, the server's network position and stored credentials extend the real-world blast radius. All three impact metrics are HIGH, reflecting complete server compromise.
Patch bypass context: The progression from CVE-2024-28986 to CVE-2024-28988 to CVE-2025-26399 demonstrates the difficulty of retroactively securing deserialization endpoints. Allowlist-based approaches to restricting deserializable classes are frequently bypassed as new gadget chains are discovered. A comprehensive fix would likely require eliminating Java native deserialization from the AjaxProxy component entirely.
Frequently Asked Questions
What is CVE-2025-26399?
CVE-2025-26399 is a CRITICAL (CVSS 9.8) unauthenticated remote code execution vulnerability in SolarWinds Web Help Desk. It exploits insecure deserialization in the AjaxProxy component and is a patch bypass for both CVE-2024-28988 and CVE-2024-28986. It is actively exploited and listed in CISA's KEV catalog with an unusually short 3-day remediation deadline.
How does CVE-2025-26399 relate to CVE-2024-28988 and CVE-2024-28986?
All three CVEs target the same fundamental deserialization flaw in the AjaxProxy component. CVE-2024-28986 was the original vulnerability, CVE-2024-28988 was a bypass of its fix, and CVE-2025-26399 is a bypass of the CVE-2024-28988 fix. Organizations must ensure they have the latest patch that specifically addresses CVE-2025-26399, as fixes for the earlier CVEs are insufficient.
How do I fix CVE-2025-26399?
Apply the latest SolarWinds Web Help Desk patch immediately — this should be treated as an emergency deployment. Verify that your patch level addresses CVE-2025-26399 specifically, not just the earlier CVEs. Additionally, restrict network access to the Web Help Desk application, conduct a compromise assessment, and rotate all credentials accessible from the server.
How severe is CVE-2025-26399?
CVE-2025-26399 is rated CRITICAL with a CVSS score of 9.8 and an EPSS score of 28.8%. It requires no authentication, has low attack complexity, and enables full remote code execution. CISA set an unusually aggressive 3-day remediation deadline (2026-03-12), indicating assessed imminent widespread exploitation. The repeated patch bypass history makes this an especially urgent concern.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.