Introduction
Attackers can execute code remotely on SolarWinds Web Help Desk servers without authenticating, by exploiting a deserialization flaw in the AjaxProxy component. The flaw has let threat actors bypass multiple earlier patches, so organizations that patched diligently stayed exposed to repeated compromise.
SolarWinds Web Help Desk is a widely used IT service management (ITSM) product. Enterprises and government agencies deploy it for ticketing, asset management, and workflow automation. It has a significant presence in the ITSM market, and its security directly affects the operations of thousands of organizations worldwide.
Technical Information
CVE-2025-26399 is an unauthenticated remote code execution vulnerability in the AjaxProxy component of SolarWinds Web Help Desk. The root cause is insecure deserialization of untrusted data (CWE-502). An attacker can send a crafted serialized payload to the AjaxProxy endpoint, and the server deserializes it without proper validation. That can run attacker-controlled code on the host system.
This vulnerability is a direct patch bypass of CVE-2024-28988, which itself bypassed the fix for CVE-2024-28986. The repeated bypasses indicate that the deserialization logic in AjaxProxy was not fully secured. Each patch left some exploitable code paths or gadget chains unaddressed, and the core deserialization mechanism stayed open to other exploitation techniques.
No public code snippets or proof of concept are available for this vulnerability. The attack needs no authentication, though, so exploitation is feasible for any remote attacker with network access to the vulnerable endpoint. That endpoint is AjaxProxy, and it is accessible in default installations of affected versions.
Affected Systems and Versions
- SolarWinds Web Help Desk versions prior to 12.8.7 Hotfix 1 are affected
- Vulnerable configurations include default and custom deployments where the AjaxProxy endpoint is accessible
- Previous patches for CVE-2024-28986 and CVE-2024-28988 do not fully mitigate this issue
Vendor Security History
Web Help Desk has a history of critical vulnerabilities, particularly Java deserialization flaws (CVE-2024-28986, CVE-2024-28988). Later vulnerabilities bypassed the patches for these issues, which indicates incomplete remediation. SolarWinds has patched quickly in some cases, but the repeated bypasses raise concerns about how thoroughly the company reviews security and validates its patches. In 2020, SolarWinds also suffered a major supply chain compromise affecting its Orion platform, another sign of persistent challenges in secure software development.
