SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability
Priority CRITICAL 100Exploited in the wildCWE-502Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.
Summary
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
Why it matters now
Exploitation Active In CISA KEV since 2026-03-09CISA due date 2026-03-12Known ransomware use
EPSS 0.90564 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SolarWinds | Web Help Desk | up to 12.8.7 | — | No fix listed | CNA |
- Web Help Desk VendorSolarWinds Affected up to 12.8.7 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:* | up to 12.8.6 | Vulnerable | SolarWinds |
| cpe:2.3:a:solarwinds:web_help_desk:12.8.7:-:*:*:*:*:*:* | 12.8.7 | Vulnerable | SolarWinds |
- cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:* Versions up to 12.8.6 Vulnerable ·SolarWinds
- cpe:2.3:a:solarwinds:web_help_desk:12.8.7:-:*:*:*:*:*:* Versions 12.8.7 Vulnerable ·SolarWinds
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-03-09 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2025-26399
- 2026-10-03 Alias added: GHSA-vfrj-f292-3f24
References
More SolarWinds Web Help Desk vulnerabilities
- TI-2025-27044 SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2025-27034 SolarWinds Web Help Desk Security Control Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-19175 SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
- TI-2024-19176 SolarWinds Web Help Desk Hardcoded Credential Vulnerability KEVCVSS 3.1CRITICAL 9.1
- TI-2025-27046 SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2025-27047 SolarWinds Web Help Desk Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-26399 · CVE Program
- CVE-2025-26399 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-vfrj-f292-3f24 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences