CVE-2025-26399 (CVSS 9.8): SolarWinds Web Help Desk Hit by Critical RCE Vulnerability

SolarWinds has released a hotfix for its Web Help Desk software after the discovery of a critical remote code execution vulnerability tracked as CVE-2025-26399, with a CVSS of 9.8. The flaw stems from an unauthenticated AjaxProxy deserialization issue and, if exploited, would allow an attacker to run commands on the host machine, presenting a full system compromise risk for exposed Web Help Desk instances.

The vulnerability was responsibly disclosed by an anonymous researcher working with Trend Micro’s Zero Day Initiative (ZDI). The hotfix is available for Web Help Desk 12.8.7 and adds HikariCP.jar while modifying whd-core.jar, whd-web.jar and whd-persistence.jar within the /lib directory, according to the advisory. Administrators are advised to stop Web Help Desk, remove the outdated c3p0.jar, back up and replace the affected JAR files with those from the hotfix, and then restart the service to apply the patch.

This patch bypass history underscores ongoing patch bypass risks associated with past deserialization flaws (CVE-2024-28988 and CVE-2024-28986) as noted by security researchers.