THREATOPS

THREAT OPS › CVEs › CVE-2025-26399

CVE-2025-26399 — SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

CISA KEVExploited: confirmedSolarWinds

SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.

Vulnerability details

Affected productsWeb Help Desk
KEV remediation due2026-03-12

Related reporting

March 2026 CVE Landscape: 31 High-Impact Vulnerabilities Identified, Interlock Ransomware Group Exploits Cisco FMC Zero-Dayrecordedfuture
Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s))watchtowr