Solar Winds Releases Hotfix for Critical CVE-2025-26399 Remote Code Execution Flaw
Summary: SolarWinds released hot fixes for CVE-2025-26399, a CVSS 9.8 unauthenticated AjaxProxy deserialization remote code execution flaw in Web Help Desk 12.8.7 and all previous versions, disclosed in an advisory on September 17, 2025 and credited to an anonymous researcher working with Trend Micro's Zero Day Initiative. The flaw is a patch bypass for CVE-2024-28988, itself a bypass for CVE-2024-28986, which SolarWinds first addressed in August 2024 and which CISA added to its Known Exploited Vulnerabilities catalog shortly after public disclosure.
Bottom line: This is the third fix for the same AjaxProxy flaw, and the original bug was exploited in the wild - so the patch history itself is the warning that a fourth bypass is plausible.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-28986CVE-2024-28988CVE-2025-26399
- Related
- Solar Winds Fixes Four Critical Web Help Desk Flaws With Unauthenticated RCE and Auth Bypass Cyber Risks ·CVE-2025-26399: Solar Winds Web Help Desk Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Mar 09, 2026CVE-2024-28986: Solar Winds Web Help Desk Deserialization of Untrusted Data Vulnerability Known Exploited Vulnerabilities · Aug 15, 2024