March 9, 2026 · Applied Cybernetics Group
CVE-2025-26399 SolarWinds Web Help Desk
known ransomware use
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
- Added to KEV
2026-03-09- Federal due date
2026-03-12- Vendor
- SolarWinds
- Product
- Web Help Desk
- EPSS
- 99.8th percentile (score 0.906, as of
2026-11-06) - NVD CVSS v3.1
- 9.8 (CRITICAL)
- Ransomware use
- Known
- Upstream
- https://nvd.nist.gov/vuln/detail/CVE-2025-26399
CISA short description
SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
NVD description
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.