SolarWinds Web Help Desk Deserialization Vulnerability Enables Command Execution

Cybersecurity authorities have identified a critical security vulnerability in SolarWinds Web Help Desk that demands immediate attention from system administrators.

Identified as CVE-2025-26399 , this flaw permits unauthorized command execution by malicious actors on the host machine.

Due to its severity and active exploitation, the Cybersecurity and Infrastructure Security Agency (CISA) has included this vulnerability in its Known Exploited Vulnerabilities catalog.

The vulnerability arises from a flaw in the deserialization of untrusted data , classified under CWE-502. This issue is located within the AjaxProxy component of SolarWinds Web Help Desk.

Deserialization involves converting data into a format that can be read and used by a system. A security issue occurs when a system deserializes data from an untrusted source without sufficient safety checks.

In the case of this vulnerability, the AjaxProxy component does not properly verify incoming data packets before processing. This allows threat actors to send malicious payloads that execute harmful instructions in the system’s memory.

Upon processing the malicious data, attackers can execute arbitrary commands on the affected host , granting them significant control over the server running the help desk software. This access can lead to data theft, user account manipulation, or further infiltration into the network.

Although it is unclear if ransomware gangs are exploiting this specific vulnerability, CISA's listing indicates active exploitation in real-world scenarios. Organizations using SolarWinds Web Help Desk are at high risk of compromise.

CISA requires federal agencies and critical infrastructure operators to secure their networks promptly.

CISA added CVE-2025-26399 to its mandate list on Mar 9, 2026 . Under Binding Operational Directive (BOD) 22-01, federal civilian executive branch agencies must address this vulnerability by Mar 12, 2026.

Though this directive targets government agencies, private sector organizations are strongly advised to adhere to the same timeline. Security teams are urged to take the following actions:

Apply the latest security patches from SolarWinds to resolve the issue in the AjaxProxy component. Follow BOD 22-01 guidance concerning the security of associated cloud services. If patches cannot be applied, discontinue the use of the product and disconnect it from the network. Monitor network logs for signs of unusual command execution, unexpected administrative access, or abnormal outbound traffic.

Based on reporting by Cyber Security News.