VulnSocial
← Back to blog

CVE-2025-26399 – Critical Remote Code Execution in SolarWinds Web Help Desk

Key takeaways

  • Critical remote code execution in SolarWinds Web Help Desk (ID: CVE-2025-26399).
  • Unauthenticated attacker can exploit an AjaxProxy deserialization flaw (CWE-502) to run arbitrary commands.
  • Active exploitation observed; added to CISA KEV on 2026‑03‑10.
  • Immediate patch to version 12.8.7‑hotfix‑1 (or later) required.
  • Monitor for exploitation indicators and verify patch deployment across all WHD instances.

Overview

The vulnerability identified as CVE-2025-26399 affects SolarWinds Web Help Desk (WHD). It is an unauthenticated remote code execution (RCE) flaw in the AjaxProxy component that deserializes attacker‑controlled data. The issue bypasses earlier mitigations for CVE‑2024‑28988 and CVE‑2024‑28986.

Technical Details

WHD’s AjaxProxy endpoint (/ajaxproxy) accepts serialized Java objects via HTTP POST. The endpoint fails to validate the source of the serialized payload, leading to a classic deserialization of untrusted data (CWE-502). An attacker can craft a malicious payload that, when deserialized, executes arbitrary OS commands with the privileges of the WHD service account.

A minimal proof‑of‑concept request looks like:

POST /ajaxproxy HTTP/1.1
Host: whd.example.com
Content-Type: application/octet-stream
Content-Length: 1234

[ serialized malicious Java object ]

When processed, the WHD server spawns a shell and runs the embedded command (e.g., whoami, net user, or a reverse‑shell payload). Because the endpoint is reachable without authentication, the attack can be launched from any network location that can reach the WHD web server.

Severity & Impact

  • CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
  • Severity: Critical
  • Impact: Full system compromise – the attacker gains command execution on the WHD host, can pivot to the internal network, and may exfiltrate ticket data or install persistent backdoors.

Affected Products

The flaw is present in Web Help Desk version 12.8.7 and earlier releases that include the vulnerable AjaxProxy component. The vendor has released a hotfix (12.8.7‑hotfix‑1) that removes the insecure deserialization path.

For the complete list of affected versions, see the CVE page.

Quick Summary Table

VendorProductAffected Version(s)CVSSCWE
SolarWindsWeb Help Desk12.8.7 (and earlier)9.8CWE-502

Actionable Insights

  • Threat activity: Since early February 2026, security researchers have observed active exploitation of this flaw. A noticeable spike in mentions occurred on 2026‑03‑10, coinciding with the addition of the vulnerability to the CISA KEV list.
  • Indicators of compromise (IOCs):
    • Unexpected inbound HTTP POSTs to /ajaxproxy from non‑trusted IP ranges.
    • Execution of unfamiliar processes (e.g., Velociraptor, QEMU SSH, custom Elastic Cloud agents) on the WHD host.
    • Outbound connections to Cloudflare tunnels or other C2 infrastructure.
  • Detection: Enable detailed request logging for the AjaxProxy endpoint, and create IDS/IPS signatures that flag serialized object payloads or abnormal HTTP methods.
  • Risk mitigation: If immediate patching is not possible, block external access to the AjaxProxy endpoint at the perimeter firewall or Web Application Firewall (WAF).

Remediation & Mitigation

  1. Patch immediately – apply the hotfix “12.8.7‑hotfix‑1” (or any later version).
    • Download from the official SolarWinds release notes: SolarWinds hotfix release notes.
    • Verify the installation via the WHD admin console (Help → About).
  2. Validate the fix – run a controlled test request to /ajaxproxy and confirm that the server returns a 403/400 error instead of processing serialized data.
  3. Network‑level protection – block unauthenticated traffic to /ajaxproxy on the perimeter or enforce strict source IP allow‑lists.
  4. Host‑level hardening – run WHD under a least‑privilege service account, and restrict the account’s OS permissions.
  5. Post‑patch monitoring – scan for remnants of exploitation (new scheduled tasks, unknown services, suspicious outbound traffic).
    • Correlate logs with the known C2 patterns (Velociraptor, Cloudflare tunnels, QEMU SSH).
  6. Update detection rules – add signatures for the malicious serialized payloads and for the specific C2 traffic observed in the wild.

Bottom Line

CVE-2025-26399 is a Critical RCE flaw in SolarWinds Web Help Desk that is already being exploited in the wild. Organizations must patch to the latest hotfix, enforce network controls around the AjaxProxy endpoint, and monitor for the described IOCs.

References

#CVE202526399 #Critical #RCE #SolarWinds #WebHelpDesk #CISAKEV