Search: CVE-2025-26399

SolarWinds Web Help Desk versions up to and including 12.8.7 are vulnerable to an unauthenticated remote code execution vulnerability via deserialization of untrusted data in the AjaxProxy component. This vulnerability is a patch bypass of previous CVEs (2024-28988 and 2024-28986) and allows attackers to execute arbitrary commands on the host system without authentication. It has a critical CVSS score of 9.8 and is known to be exploited in the wild, including use in ransomware campaigns.