EXPOSURES › CVE-2025-26399

CVE-2025-26399

HIGH ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2026-03-09 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2025-26399 ↗

⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 85/100 rceexploited-in-wildransomwaresupply-chainunpatchednegligence

SolarWinds Web Help Desk allows remote command execution via untrusted data deserialization in AjaxProxy.

This vulnerability enables attackers to execute arbitrary commands on compromised systems, posing a severe risk to DIB organizations relying on SolarWinds infrastructure. Immediate patching and network segmentation are critical to prevent unauthorized access and potential data exfiltration.

Shame score — A critical RCE vulnerability in a widely deployed product that is actively exploited in the wild, indicating a failure to patch or secure the supply chain.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

SolarWinds · vendor Web Help Desk · product

DESCRIPTION

SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.

AFFECTED FEDRAMP PRODUCTS · 0

No correlated FedRAMP products.