Web Help Desk - RCE (CVE-2025-26399)

CVE-2025-26399 is a critical unauthenticated deserialization vulnerability in SolarWinds Web Help Desk that enables remote code execution through the AjaxProxy component. Attackers can exploit this patch bypass remotely without authentication to execute commands on the host, potentially compromising confidential data, altering systems, and disrupting service availability.

CrowdSec has been tracking this vulnerability and its exploits since 25th of August 2026.

CrowdSec network data shows that most actors exploiting CVE-2025-26399 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2025-26399 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2025-26399 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attackers target the SolarWinds Web Help Desk endpoint /helpdesk/WebObjects/Helpdesk.woa; exposure is indicated by identifying Web Help Desk branding and versions earlier than 12.8.7, which are vulnerable to unauthenticated AjaxProxy deserialization leading to remote code execution.