SolarWinds fixed a critical RCE flaw in its Web Help Desk software

SolarWinds has fixed a critical remote code execution flaw in its Web Help Desk software, tracked as CVE-2025-26399 with a CVSS of 9.8, after an anonymous researcher working with the Trend Micro Zero Day Initiative reported the issue. The vulnerability could allow attackers to execute arbitrary commands on vulnerable systems via unauthenticated AjaxProxy deserialization, bypassing fixes for CVE-2024-28988 and CVE-2024-28986. The flaw affects SolarWinds Web Help Desk version 12.8.7 and all preceding versions.

According to SolarWinds advisory, the vulnerability is a deserialization vulnerability that could enable command execution on the host machine if exploited. The company has released hot fixes and urged users to apply them promptly; there is currently no evidence suggesting the vulnerability is being actively exploited in the wild. The report notes the fix was publicised on 24 September 2025.