CVE-2025-26399 – Immediate actions for SolarWinds Web Help Desk

What is CVE-2025-26399?

This is a critical flaw in SolarWinds Web Help Desk. The vulnerability lives in the AjaxProxy component and allows an attacker to feed the application crafted data that gets deserialized without proper checks. Once the malicious payload is processed the attacker can execute arbitrary commands on the host that runs the help‑desk service. The CVSS score is 9.8, placing it in the highest risk tier. CISA has listed it as a known exploited vulnerability and confirms that ransomware groups have used it in the wild.

For the wider picture, our Known Exploited Vulnerabilities tracker lists every flaw CISA has confirmed under active attack.

How does the flaw work?

At its core the issue is an insecure deserialization. The application receives data from a web request, hands it to a Java (or.NET) deserializer, and trusts the resulting object graph. Deserializers will recreate any class that the attacker can reference, and many of those classes have methods that run system commands. By constructing a payload that points the deserializer at such a class, the attacker can cause the help‑desk process to launch a shell, read files, or start any other command the underlying OS permits.

The exact details of the payload format have not been published by the vendor or any public researcher. What we do know is that the vulnerable entry point is the AjaxProxy endpoint that accepts JSON‑encoded requests. The endpoint does not validate the type information contained in the payload, nor does it enforce a whitelist of safe classes. That lack of validation is the root cause.

Am I affected?

If you run SolarWinds Web Help Desk, you are in the scope of this advisory. The National Vulnerability Database lists all releases up to a certain point as vulnerable. The table below shows which releases are affected and which contain the fix. Your job is to verify which release you are currently using.

There are three reliable ways to discover the version that is installed:

• Log in to the Web Help Desk web UI and navigate to the “About” or “System Information” page. The version string is displayed there.
• If you have command‑line access to the server, run the binary with the version flag. The typical command is whd --version (replace whd with the actual executable name if it differs).
• Inspect the file VERSION.txt or release.info in the installation directory – the version is written in plain text.

Compare the string you see with the entries in the table below. If your version appears in the vulnerable column, you are exposed.

What is the impact?

Because the flaw permits command execution, an attacker who can reach the AjaxProxy endpoint can gain full control of the host. In practice that means they can install ransomware, exfiltrate data, or pivot to other systems on the network. The fact that CISA has recorded active ransomware use demonstrates that the risk is not theoretical.

The CVSS vector reflects the ease of exploitation (network‑accessible), the lack of authentication, and the high impact on confidentiality, integrity and availability. In short, if the vulnerability is present and reachable, the attacker can do almost anything they want on that machine.

What can I do right now?

Follow these steps in the order presented. Each step is a short, concrete action you can type into a terminal or click in the UI.

1. Verify your current release

Run one of the commands above, or open the “About” page. Write down the exact version string – you will need it when you check the table.

2. Apply the vendor patch

The vendor has released a patched build for every supported branch. The instruction from SolarWinds is to download the latest release that matches your branch and install it using the normal upgrade process. In practice that means:

• Stop the Web Help Desk service (systemctl stop whd or use the Windows Services console).
• Back up the current installation directory and the database.
• Replace the binaries with the ones from the patched package.
• Start the service again (systemctl start whd or the Services console).

After the service restarts, repeat the version check to confirm you are now on the patched release.

3. Apply vendor‑provided mitigations

If, for any reason, you cannot upgrade immediately, SolarWinds supplies a temporary mitigation. The mitigation is a configuration change that disables the vulnerable AjaxProxy endpoint. To enable it:

• Open the file webhelpdesk.conf (location varies by OS, usually under /etc/whd/ or C:\Program Files\SolarWinds\WebHelpDesk\).
• Find the line that reads ajaxproxy.enabled=true and change the value to false.
• Save the file and restart the service.

Disabling the endpoint blocks the attack vector but also disables any legitimate functionality that depends on AjaxProxy. Test your environment after the change to ensure critical workflows still work.

4. Follow BOD 22‑01 guidance for cloud services

If you host Web Help Desk in a cloud environment, CISA requires you to apply the same mitigations and also to review your cloud‑specific security controls. That includes ensuring the service is not exposed to the public internet unless absolutely necessary, using network ACLs to restrict access to known IP ranges, and enabling multi‑factor authentication for all accounts that can manage the product.

If a patch isn’t available

In the unlikely event that you cannot obtain the patched build – for example, you are locked onto an older branch that the vendor no longer supports – you have two options:

• Isolate the server. Remove it from any network segment that can be reached from the internet or from untrusted internal hosts. Use firewall rules to allow only the IP addresses of your internal help‑desk users.
• Replace the product. SolarWinds themselves advise discontinuing use if no mitigation exists for your branch. Evaluate alternative ticketing systems and plan a migration.

While you are working on a long‑term solution, keep the mitigation described in step three active, monitor logs for any attempts to hit the AjaxProxy endpoint, and consider enabling an intrusion‑detection system that can alert on suspicious deserialization payloads.

Summary

CVE-2025-26399 is a critical remote‑code‑execution flaw in SolarWinds Web Help Desk. It has been confirmed in the wild and is being used by ransomware operators. The vulnerability stems from insecure deserialization in the AjaxProxy component. To protect yourself, first confirm the version you are running, then upgrade to the patched release for your branch. If you cannot upgrade immediately, disable the vulnerable endpoint and tighten network access. Should a fix be unavailable, isolate or retire the product. The table below lists the affected and fixed releases – use it to verify your status.

Affected versions

Straight from the NVD record for CVE-2025-26399. If your build is inside one of these ranges, treat it as vulnerable.

Product	Affected range	Fixed in
web_help_desk	* up to 12.8.6	see vendor advisory