CVE-2025-26399
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 89.50%
- CISA KEV
- Known exploited vulnerability
- CWE
- CWE-502
- Published
- 2025-09-23
- Last modified
- 2026-08-04
Affected products
- SolarWinds Web Help Desk
Weakness type
Related vulnerabilities
- CVE-2026-87874 — Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller
- CVE-2024-58381 — PocketMine-MP before 5.11.1 Denial of Service via LoginPacket
- CVE-2026-11363 — Ninja Forms <= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import
- CVE-2026-87083 — tile-ai tilelang Kernel Cache kernel_cache.py KernelCache._load_kernel_from_disk deserialization
- CVE-2026-81385 — Microsoft Office Publisher Remote Code Execution Vulnerability
- CVE-2026-77484 — Microsoft SQL Server Remote Code Execution Vulnerability
- CVE-2026-65772 — Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
- CVE-2026-47297 — Microsoft SQL Server Remote Code Execution Vulnerability