SolarWinds Releases Hotfix for Critical CVE-2025-26399 Remote Code Execution Flaw

SolarWinds has released hot fixes to address a critical vulnerability tracked as CVE-2025-26399 in its Web Help Desk software, which could allow remote code execution with an CVSS score of 9.8. The flaw is described as an unauthenticated AjaxProxy deserialization vulnerability that could enable attackers to run commands on affected hosts, and it affects Web Help Desk 12.8.7 and all earlier versions.

SolarWinds notes that CVE-2025-26399 is a patch bypass for CVE-2024-28988, which in turn bypassed CVE-2024-28986; the original bugs were patched previously in 2024. An anonymous researcher working with Trend Micro Zero Day Initiative (ZDI) is credited with discovering and reporting the flaw, and the ZDI advisory states that the vulnerability allows remote code execution with no authentication required.

There is currently no public information about active exploitation, but users are urged to update to SolarWinds Web Help Desk 12.8.7 HF1 for protection. CVE-2025-26399 has been added to the KEV catalog by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).