CVE-2025-26399
CRITICAL KEVSolarWinds Web Help Desk < 12.8.6 - Unauthenticated Remote Code Execution via AjaxProxy Deserialization
Title source: llmExploitation Summary
CVE-2025-26399 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added March 9, 2026. EIP tracks 1 public exploit from researchers including rxerium.
AI-analyzed exploit summary This repository provides a Nuclei template for detecting SolarWinds Web Help Desk instances vulnerable to CVE-2025-26399 by checking the version against a known vulnerable range. It does not include an exploit but aids in identification.
Description
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
Exploits (1)
This repository provides a Nuclei template for detecting SolarWinds Web Help Desk instances vulnerable to CVE-2025-26399 by checking the version against a known vulnerable range. It does not include an exploit but aids in identification.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H