VULNERABILITY INTELLIGENCE

CVE-2025-26399

CVSS score9.8 CRITICAL
EPSS probability90.56%
CISA KEVKnown exploited vulnerability
Published2025-09-23
Last modified2026-10-11
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Vendor / product: SolarWinds / Web Help Desk

Description

SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.

Weakness classification

  • psirt@solarwinds.com: CWE-502
  • nvd@nist.gov: CWE-502

Primary references