Active Exploitation of SolarWinds Web Help Desk Insecure Deserialization (CVE-2025-26399)
CVE-2025-26399 is a critical insecure deserialization flaw (CWE-502) in SolarWinds Web Help Desk that enables unauthenticated remote code execution/command execution over the network. The issue resides in the product’s AjaxProxy component, where untrusted serialized data can be processed without sufficient validation, allowing an attacker to deliver a crafted payload that results in arbitrary command execution on the host running the help desk application.
Multiple reports indicate the vulnerability is actively exploited in the wild, prompting CISA to add CVE-2025-26399 to the Known Exploited Vulnerabilities (KEV) catalog. NetSPI notes the flaw was disclosed in 2025 and is described as a patch bypass related to earlier issues (CVE-2024-28988 and CVE-2024-28986), and recommends immediate remediation by upgrading to SolarWinds Web Help Desk 12.8.7 Hotfix 1 or later; if patching is delayed, organizations should restrict network exposure of the server and increase monitoring for suspicious process execution and outbound connections.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
Federal remediation deadline arrives for CVE-2025-26399
CISA set March 12, 2026 as the deadline for affected federal agencies to remediate CVE-2025-26399 or discontinue use of the vulnerable product if patching was not possible. Guidance also called for monitoring for suspicious activity and restricting exposure.
CISA adds CVE-2025-26399 to the KEV catalog
CISA added CVE-2025-26399 to its Known Exploited Vulnerabilities catalog after determining the SolarWinds Web Help Desk flaw was being actively exploited in the wild. The addition also placed the vulnerability under BOD 22-01 remediation requirements for U.S. federal civilian executive branch agencies.
SolarWinds patches CVE-2025-26399 in Web Help Desk 12.8.7 Hotfix 1
SolarWinds released Web Help Desk 12.8.7 Hotfix 1 as the earliest patched version addressing CVE-2025-26399, an unauthenticated remote code execution flaw in the AjaxProxy component. The issue was disclosed in 2025 and described as a bypass of fixes for CVE-2024-28988 and CVE-2024-28986.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Active Exploitation of SolarWinds Web Help Desk Flaws Enables Remote Code Execution
SolarWinds warned that multiple vulnerabilities in **Web Help Desk** are being actively exploited, with reporting highlighting a critical flaw that can lead to **remote code execution** on exposed help-desk servers. Public references tie the activity to `CVE-2025-40554`, while additional SolarWinds advisories and third-party research point to related issues including `CVE-2025-40552`, `CVE-2025-40553`, and `CVE-2025-40536`, indicating a broader security problem affecting the product. Security researchers and defenders published proof-of-concept material and detection guidance shortly after disclosure, including a watchTowr repository focused on Web Help Desk exploitation and a GitHub Gist describing **uncommon process activity** associated with compromise. The combination of vendor advisories, media reporting, and public exploit research indicates that attackers moved quickly to weaponize the flaws, increasing risk for organizations that have not patched, isolated, or monitored SolarWinds Web Help Desk deployments.
Jul 1, 2026
CISA Orders Patching of Exploited SolarWinds Web Help Desk RCE (CVE-2025-40551)
The U.S. Cybersecurity and Infrastructure Security Agency (**CISA**) added **CVE-2025-40551**—a critical (CVSS 9.8) *SolarWinds Web Help Desk (WHD)* vulnerability—to its **Known Exploited Vulnerabilities (KEV)** catalog after confirming active exploitation. The flaw is described as **deserialization of untrusted data** that can enable **unauthenticated remote code execution**, potentially allowing full compromise of affected WHD servers; the issue was reported to SolarWinds by Horizon3.ai researcher **Jimi Sebree**. CISA also issued a directive requiring U.S. federal civilian agencies to patch CVE-2025-40551 by the stated deadline, and SolarWinds released a fix in *Web Help Desk* version **2026.1**. Reporting tied the bug to a prior WHD issue (**CVE-2024-28986**) and characterized CVE-2025-40551 as part of a sequence of vulnerabilities involving bypasses of earlier fixes; CISA’s KEV update also included additional exploited flaws in **Sangoma FreePBX** (including **CVE-2019-19006** and **CVE-2025-64328**) and **GitLab** (**CVE-2021-39935**, SSRF), expanding the set of vulnerabilities agencies must remediate under KEV timelines.
Jun 29, 2026
Critical RCE and Authentication Bypass Vulnerabilities in SolarWinds Web Help Desk
SolarWinds released security updates for *Web Help Desk (WHD)* to address multiple critical vulnerabilities that could allow **unauthenticated remote attackers** to bypass authentication and achieve **remote code execution (RCE)**. The patched issues include two critical authentication bypass flaws, **CVE-2025-40552** and **CVE-2025-40554** (reported by watchTowr researcher Piotr Bazydlo), and two critical RCE flaws tied to **untrusted data deserialization**, **CVE-2025-40553** (Bazydlo) and **CVE-2025-40551** (reported by Horizon3.ai researcher Jimi Sebree), enabling remote command execution without prior access. SolarWinds also fixed a high-severity **hardcoded credentials** issue, **CVE-2025-40537**, which could enable unauthorized access to administrative functions under certain conditions. The vendor advised administrators to upgrade to **Web Help Desk 2026.1** and patch quickly, noting WHD has a history of being targeted and previously had vulnerabilities flagged as actively exploited by CISA, reinforcing the likelihood of rapid attacker interest following disclosure and patch availability.
Jun 29, 2026