CVE-2025-26399 SolarWinds Web Help Desk
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of…
- CVSS
- 9.8 Critical
- EPSS
- 91%
- Percentile
- 100
- Published
- 2025-09-23
- Force
- 11 of 12
- Public PoC
- 1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
On CISA’s exploited list
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
- Added
- 2026-03-09
- Federal patch deadline
- 2026-03-12
- Ransomware use
- known