SolarWinds Web Help Desk Vulnerability Enables Privilege Escalation

A critical vulnerability in SolarWinds Web Help Desk (WHD) could allow unauthenticated attackers to escalate privileges and execute remote code on affected systems, with the flaw residing in the AjaxProxy deserialization mechanism. The issue is tracked as CVE-2025-26399 and affects unpatched WHD installations running version 12.8.7, with a patch released as Web Help Desk 12.8.7 Hotfix 1 on 23 September 2025.

Exploitation could give attackers the same privileges as the WHD service account, potentially enabling full administrative control over ticketing data, user credentials, and system configuration, and bypasses to earlier fixes (CVE-2024-28988 and CVE-2024-28986) remain at risk until the hotfix is applied.

According to SolarWinds, administrators should install Hotfix 1 immediately, replace vulnerable JAR files in the WebHelpDesk directory, and restart the WHD service to fully remediate CVE-2025-26399, with specific guidance to back up c3p0.jar, whd-core.jar, whd-web.jar, and whd-persistence.jar before updating.

The update also adds a Wrd new HikariCP.jar component and provides detailed upgrade instructions in SolarWinds’ documentation, emphasising top-priority handling due to high severity and potential operational impact.