Home

Description

SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.

PUBLISHED Reserved 2025-02-08 | Published 2025-09-23 | Updated 2025-09-24 | Assigner SolarWinds




CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-502: Deserialization of Untrusted Data

Product status

Default status
unaffected

12.8.7 and below
affected

Credits

Anonymous working with Trend Micro Zero Day Initiative reporter

References

www.solarwinds.com/...ter/security-advisories/CVE-2025-26399

documentation.solarwinds.com/...7-hotfix-1_release_notes.htm

cve.org (CVE-2025-26399)

nvd.nist.gov (CVE-2025-26399)

Download JSON