NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

SolarWinds Web Help Desk CVE-2025-26399 remote code execution flaw exploited in attacks; fixed in 12.8.7 Hotfix 1

SolarWinds Web Help Desk 12.8.7 and earlier has a login-free remote code execution flaw (CVE-2025-26399). CISA lists it as exploited. Organisations running it should install 12.8.7 Hotfix 1 or later and rotate credentials. Not a consumer product.

What to do

If your organisation runs SolarWinds Web Help Desk, install 12.8.7 Hotfix 1 or a later release, keep the server off the public internet, and rotate service and admin passwords reachable from it. Home users have nothing to do.

What’s happening

CVE-2025-26399 is a critical flaw in SolarWinds Web Help Desk, an IT help-desk and ticketing server used by businesses. A deserialization weakness in a component called AjaxProxy lets an attacker who can reach the server run commands on it without logging in. SolarWinds says it affects version 12.8.7 and everything earlier, and it was fixed in 12.8.7 Hotfix 1, released on 23 September 2025. The flaw is a bypass of two earlier fixes (CVE-2024-28988 and CVE-2024-28986). CISA added it to its list of exploited flaws on 9 March 2026. Microsoft reported in February 2026 that attackers had used exposed Web Help Desk servers to get into networks and steal administrator credentials, but said it could not confirm which flaw gave entry, because the servers were open to several. Security reporting links some of this activity to the Warlock ransomware group, though that link is not settled, and sources differ on whether CISA marks ransomware use. The fix is available. It is not a home product.

What
Flaw
Affects
SolarWinds Web Help Desk (IT help-desk server)
Affected
SolarWinds Web Help Desk 12.8.7 and all previous versions
Fixed in
Web Help Desk 12.8.7 Hotfix 1
CVE
CVE-2025-26399
Since
9 Mar 2026
Closed
9 Mar 2026

Timeline

  1. CISA added

    CISA added CVE-2025-26399 to its Known Exploited Vulnerabilities catalogue. Press coverage reports that Huntress saw exploitation at three customers in February.

  2. Wider attacks

    Microsoft reported attackers had broken into organisations through exposed Web Help Desk servers from December 2025, then stolen high-privilege credentials. Microsoft said it could not confirm which CVE gave the first foothold, because the servers were exposed to several flaws, including CVE-2025-40551, CVE-2025-40536 and CVE-2025-26399.

  3. New fixFixed

    SolarWinds released Web Help Desk 12.8.7 Hotfix 1, which fixes CVE-2025-26399. It requires 12.8.7 to be installed first and is applied by replacing several files.

  4. Made publicNo fix yet

    SolarWinds first published its advisory for CVE-2025-26399, an unauthenticated remote code execution flaw in Web Help Desk's AjaxProxy component affecting 12.8.7 and all earlier versions. It is a bypass of the fix for CVE-2024-28988, which itself bypassed the fix for CVE-2024-28986.

Sources

  1. SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability, CVE-2025-26399SolarWinds · 17 Sept 2025
  2. Web Help Desk 12.8.7 Hotfix 1 release notesSolarWinds · 23 Sept 2025
  3. Someone's attacking SolarWinds WHD to steal high-privilege credentialsThe Register · 9 Feb 2026
  4. US cyber agency warns of exploitation of three vulnerabilities including SolarWinds and Ivanti bugsCyber Daily · 10 Mar 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from March 2026 · JSON · RSS