SolarWinds Makes Third Attempt at Patching Exploited Vulnerability

SolarWinds has issued a hotfix for a remote code execution vulnerability in Web Help Desk, marking what the firm calls its third attempt at patching the deserialization flaw tracked as CVE-2025-26399 (CVSS 9.8). The vulnerability is described as an unauthenticated AjaxProxy deserialization RCE that could allow attackers to execute commands on the host, and SolarWinds notes this is a patch bypass of CVE-2024-28988, which itself bypassed CVE-2024-28986.

The company released Web Help Desk 12.8.7 Hotfix 1 to address CVE-2025-26399, following a first hotfix in August 2024 and a second hotfix later that addressed CVE-2024-28987. In mid-October 2024, the US agency CISA warned that hardcoded credentials had been exploited in attacks, and SolarWinds subsequently provided a third hotfix that also resolves CVE-2024-28988.

The article notes that there have been no reports of CVE-2024-28988 being exploited in the wild, but advises prompt application of the hotfix given the vulnerability’s severity and prior exploitation history. according to CISA, this latest patch bypass has now been addressed with the Web Help Desk 12.8.7 Hotfix 1 release.