SolarWinds has issued an urgent security advisory for a critical vulnerability in its Web Help Desk, which could allow an unauthorized attacker to achieve remote code execution (RCE).
See also: What does SolarWinds say about the Salesloft Drift hack?
The vulnerability, tracked as CVE-2025-26399, has a critical severity rating of 9.8 out of 10, underscoring the serious risk it poses to affected systems. The issue arises from the deserialization of untrusted data in the AjaxProxy of the software.
According to the advisory, the vulnerability allows a remote attacker to execute arbitrary commands on the host machine without requiring credentials. This issue is particularly concerning as it bypasses fixes for two previously addressed vulnerabilities, CVE-2024-28988 and CVE-2024-28986.
This re-emergence suggests a persistent weakness in the software's handling of serialized data, allowing security researchers to find new ways to exploit the same underlying problem.
See also: SolarWinds Dameware Vulnerability Allows Privilege Escalation
SolarWinds has credited an anonymous researcher working with Trend Micro for discovering and responsibly disclosing this latest version of the vulnerability.
In response to the discovery, SolarWinds has released Web Help Desk 12.8.7 Hotfix 1.The company strongly urges all customers who have downloaded and installed version 12.8.7 to apply this hotfix immediately to mitigate the risk of exploitation.
The fix addresses the vulnerability by modifying several core files, including whd-core.jar, whd-web.jar, and whd-persistence.jar, and adding the HikariCP.jar. Administrators are advised to stop the Web Help Desk service, back up and replace the specified files, and then restart the service to complete the installation.
See also: SolarWinds XSS vulnerability allows malware insertion
Failure to apply the hotfix leaves systems exposed to potential takeover by remote attackers.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
