CVE-2025-26399 SolarWinds Web Help Desk Overview and Takeaways
A critical vulnerability (CVE-2025-26399) has been identified in SolarWinds Web Help Desk, which allows unauthenticated remote attackers to execute arbitrary code on affected systems. Although CVE-2025-26399 was originally disclosed in 2025, recent reports confirm this vulnerability is now being actively exploited in the wild. This development significantly elevates the risk to impacted environments. Immediate remediation is required to prevent compromise.
What do I need to know?
- CVE ID: CVE-2025-26399
- Severity: Critical (CVSS 3.1 Score: 9.8)
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Impact: Full compromise of confidentiality, integrity, and availability
- Root Cause: Insecure deserialization of Untrusted Data (CWE-502) in the AjaxProxy component
Products & Systems Affected
- Earliest Patched Version:
12.8.7 Hotfix 1
- Exploit Status:
Actively exploited; listed in CISA’s Known Exploited Vulnerabilities Catalog
- Related CVEs:
CVE-2025-26399 is a bypass of patches for CVE-2024-28988 and CVE-2024-28986
What do I need to do?
We recommend the following steps to identify and remediate this vulnerability:
- Apply the vendor patch:
- Upgrade to SolarWinds Web Help Desk 12.8.7 Hotfix 1, or newer, immediately.
- SolarWinds Advisory & Patch Download
- If patching is not immediately possible:
- Restrict network access to the Web Help Desk server.
- Monitor for suspicious activity, including unexpected process execution and outbound connections.
- Audit and Monitor:
- Review logs for signs of exploitation attempts.
- Implement additional endpoint detection and response (EDR) monitoring for anomalous behavior.
NetSPI Product and Services Coverage
NetSPI’s External Attack Surface Management is issuing a version-based detection for this CVE, which will present as: Vulnerable Version – SolarWinds Web Help Desk Insecure Deserialization (CVE-2025-26399).
NetSPI’s Penetration Testing Services can also help identify exposure to this vulnerability.
Explore More Blog Posts
CVE-2026-78902: XSS to RCE in pfSense with one DNS request
Discover how a single DNS request can chain a stored Cross-Site Scripting (XSS) vulnerability into Remote Code Execution (RCE) on pfSense firewalls. Read the full technical breakdown of CVE-2026-78902 affecting the popular pfBlockerNG package.
“StyleSmuggler” – Adobe Commerce, Adobe Commerce B2B, and Magento RCE (CVE-2026-75650): Overview and Takeaways
Adobe disclosed CVE-2026-7565, dubbed “StyleSmuggler,” on September 7th, 2026. The vulnerability, which received a maximal initial CVSS score of 10.0, affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw allows an unauthenticated network-based attacker to execute arbitrary code by injecting PHP through Magento's email template engine.
Modern Adventures in Azure Privilege Escalation
Azure has been growing rapidly over the past few years As of June 2026, there were over 200 services, 897 built-in Azure RBAC roles, and 22,018 different permissions. The attack surface of Azure has also increased with this growth. There are also a number of new and updated tools that give us insight into the […]