CVE-2025-26399

This vulnerability is like a hidden “backdoor door” in the help desk software. If someone can reach your system, they can send a special message that tricks the software into running commands on the server—without needing a username or password. Once that happens, attackers can take over the machine and use it to steal data or disrupt your operations.

This matters if your business runs SolarWinds Web Help Desk (including deployments commonly referred to as Web Help Desk) on a server that attackers can reach. The key risk is reachability: it is network-exploitable with no authentication and no user interaction, and it is reachable in a default configuration. If the Web Help Desk service is exposed to the internet or otherwise reachable from attacker-controlled networks, you should treat it as actively dangerous.

This is RED because it is confirmed in the CISA Known Exploited Vulnerabilities catalog and is being used in ransomware campaigns. It requires no authentication and has been reported as actively targeted, so a delay increases the chance of compromise. Follow the vendor upgrade immediately and meet CISA’s action deadline.

1. Confirm exposure (fast check)

   • Identify whether SolarWinds Web Help Desk / Web Help Desk is installed on any reachable server.
   • Determine how it’s exposed:
     • If it is reachable from the internet, treat as exposed.
     • If it is only reachable via a VPN or restricted internal network, you still need to confirm no broad network paths exist.

2. Confirm version

   • On each Web Help Desk instance, record the exact installed version.
   • The remediation guidance provided by SolarWinds specifies upgrading to version 12.8.7 HF1.

3. Upgrade to the fixed version (primary remediation)

   • Upgrade SolarWinds Web Help Desk to version 12.8.7 HF1 as soon as practical.
   • Use only trusted update sources as emphasized in the vendor remediation notes.

4. If you cannot upgrade immediately (containment while upgrading)

   • Remove or restrict internet exposure for Web Help Desk.
   • Ensure only trusted networks can reach it (for example, access only through a VPN or tightly scoped allow-lists), and block all other network paths to the service.
   • Apply any other compensating mitigations SolarWinds instructs for this issue, and follow CISA guidance for cloud services if applicable.

5. Incident-proofing checks after upgrade/containment

   • Review server logs around the time windows when the service was exposed.
   • Look for unusual process creation, unexpected command execution patterns, and repeated requests to the AjaxProxy endpoint.
   • Ensure the service is again restricted to the intended access paths.

6. Deadline and governance

   • CISA due date for required action: 2026-03-12.

7. What to monitor going forward

   • Continued reachability (re-check firewall/network rules after maintenance).
   • Repeated unauthenticated requests hitting the application endpoints.
   • Any signs of persistence or post-exploitation activity on the host.

Severity and status: This vulnerability is categorized as CRITICAL (CVSS 9.8) with confirmed real-world exploitation tracked by CISA (added to KEV; used in ransomware campaigns). Exploitation involves sending crafted network requests to SolarWinds Web Help Desk’s AjaxProxy component.

Weakness: CWE-502 (deserialization of untrusted data). The server deserializes attacker-controlled data in a way that enables arbitrary command execution.

Attack mechanism and reachability: No authentication is required (PR:N), no user interaction is needed (UI:N), and it is reachable in default configuration. The practical outcome is remote code execution on the host, potentially leading to full compromise.

Exploit maturity: Exploitation is reported as actively targeted based on the KEV listing, and press attention is described as sustained.

Patch/upgrade guidance: SolarWinds recommends upgrading to Web Help Desk version 12.8.7 HF1 as soon as practical. Note the technical description indicates this is a patch bypass chain (CVE-2025-26399 bypasses CVE-2024-28988, which in turn bypasses CVE-2024-28986), reinforcing the need to upgrade to the stated fixed release rather than relying on older mitigations.

KEV meaning: Inclusion in the CISA Known Exploited Vulnerabilities catalog indicates that CISA considers the vulnerability to be exploited in the wild, triggering strong remediation expectations.