"SolarWinds has released hot fixes to address a critical security flaw impacting its Web Help Desk software that, if successfully exploited, could allow attackers to execute arbitrary commands on susceptible systems. The vulnerability, tracked as CVE-2025-26399 (CVSS score: 9.8), has been described as an instance of deserialization of untrusted data that could result in code execution. It affects SolarWinds Web Help Desk 12.8.7 and all previous versions."
""SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine," SolarWinds said in an advisory released on September 17, 2025. An anonymous researcher working with the Trend Micro Zero Day Initiative (ZDI) has been credited with discovering and reporting the flaw."
"SolarWinds said CVE-2025-26399 is a patch bypass for CVE-2024-28988 (CVSS score: 9.8), which, in turn, is a bypass for CVE-2024-28986 (CVSS score: 9.8) that was originally addressed by the company back in August 2024. "This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Web Help Desk. Authentication is not required to exploit this vulnerability," according to a ZDI advisory for CVE-2024-28988."
""The specific flaw exists within the AjaxProxy. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM." While there is no evidence of the vulnerability being exploited in the wild, users are advised to update their instances to SolarWinds Web Help Desk 12.8.7 HF1 for optimal protection."
A critical unauthenticated deserialization vulnerability, CVE-2025-26399 (CVSS 9.8), affects SolarWinds Web Help Desk 12.8.7 and earlier versions and can enable remote code execution. The flaw resides in the AjaxProxy component and stems from improper validation of user-supplied data, allowing deserialization of untrusted input and execution in the context of SYSTEM. The issue was reported by an anonymous researcher working with the Trend Micro Zero Day Initiative (ZDI). CVE-2025-26399 is a patch bypass for earlier CVEs including CVE-2024-28988 and CVE-2024-28986. No in-the-wild exploitation has been observed; updating to 12.8.7 HF1 is recommended.
Read at The Hacker News
Unable to calculate read time
Collection
[
|
...
]