SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE

Exploited in the wild. Listed by CISA on 2026-03-09; known to be used by ransomware.

criticalseverity

9.8CVSS score

90.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges.

Impact

Attackers can execute arbitrary commands on the host machine remotely without authentication, leading to full system compromise.

Fix

Update to the latest version that addresses this vulnerability.

How to confirm it

Send: GET /helpdesk/WebObjects/Helpdesk.woa
Positive when: status_code == 200 and contains_any(body, "Web Help Desk Software", "SolarWinds WorldWide", "HCS Web Help Desk") and compare_versions(version, "< 12.8.7")

Run it with nuclei: nuclei -id CVE-2025-26399 -u <target>

The full check

id: CVE-2025-26399

info:
  name: SolarWinds Web Help Desk < 12.8.7 - AjaxProxy Deserialization RCE
  author: popy21
  severity: critical
  description: |
    SolarWinds Web Help Desk contains an unauthenticated AjaxProxy deserialization remote code execution vulnerability, letting attackers run commands on the host machine without authentication, exploit requires no special privileges.
  impact: |
    Attackers can execute arbitrary commands on the host machine remotely without authentication, leading to full system compromise.
  remediation: |
    Update to the latest version that addresses this vulnerability.
  reference:
    - https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm
    - https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399
    - https://nvd.nist.gov/vuln/detail/CVE-2025-26399
    - https://labs.watchtowr.com/buy-a-help-desk-bundle-a-remote-access-solution-solarwinds-web-help-desk-pre-auth-rce-chain-s/
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-26399
    cwe-id: CWE-502
    epss-score: 0.90564
    epss-percentile: 0.99804
    cpe: cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: solarwinds
    product: web_help_desk
    cisa-kev: true
    shodan-query: http.favicon.hash:"1895809524"
    fofa-query: icon_hash="1895809524"
  tags: cve,cve2025,solarwinds,webhelpdesk,deserialization,rce,kev,vkev,passive

http:
  - raw:
      - |
        GET /helpdesk/WebObjects/Helpdesk.woa HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "Web Help Desk Software", "SolarWinds WorldWide", "HCS Web Help Desk")'
          - 'compare_versions(version, "< 12.8.7")'
        condition: and

    extractors:
      - type: regex
        name: build_token
        part: body
        group: 1
        regex:
          - "\\?v=([0-9]+_[0-9]+_[0-9]+_[0-9]+)"
        internal: true

      - type: dsl
        name: version
        dsl:
          - 'replace(build_token, "_", ".")'

References

Use this check only on systems you are authorised to test. Where the data comes from