CVE-2025-26399

What it actually does

CVE-2025-26399 is an unauthenticated remote code execution vulnerability in SolarWinds Web Help Desk involving unsafe deserialization through the AjaxProxy component. A remote attacker can send specially crafted serialized data to the exposed Web Help Desk service and cause the application server to deserialize attacker-controlled objects, resulting in command execution on the underlying host with the privileges of the Web Help Desk/Tomcat process. Because the flaw requires no authentication, no user interaction, and has high confidentiality, integrity, and availability impact, successful exploitation can lead to full application-server compromise, data theft, persistence, and lateral movement. This issue is also a bypass of prior fixes for CVE-2024-28988 and CVE-2024-28986, so systems patched only for the earlier issues may still be exposed if they have not received the vendor’s later corrective update.

Why it matters to the business

Compromise of SolarWinds Web Help Desk can give attackers control over a help desk platform that often contains user details, support tickets, attachments, internal troubleshooting notes, asset information, and credentials or secrets inadvertently shared in tickets. Since this vulnerability is listed in CISA KEV, has active in-the-wild exploitation, a very high EPSS score, and is associated with ransomware activity including the Interlock campaign, exposed systems should be treated as high-risk internet-facing infrastructure. Operational consequences may include help desk outage, ransomware deployment, theft of sensitive support data, attacker pivoting into internal systems, and loss of trust in IT support workflows. CISA’s KEV remediation due date is 2026-03-12, but organizations should remediate immediately rather than waiting for the deadline.

How an attack unfolds

An attacker first identifies an exposed SolarWinds Web Help Desk instance, commonly by scanning for the Web Help Desk web interface and its Java/Tomcat-backed endpoints. The attacker then sends a crafted unauthenticated request to the AjaxProxy functionality containing malicious serialized data. When the vulnerable server processes the request, it deserializes attacker-controlled content and triggers a gadget chain or similar execution path that runs commands on the host. The attacker may use the initial command execution to verify access, write a web shell or loader, spawn system utilities, download additional tooling, establish persistence, dump configuration data, access ticket contents and attachments, and move laterally using credentials or network trust available to the Web Help Desk server. In ransomware-linked exploitation, the RCE may be used as an entry point for reconnaissance, credential theft, privilege escalation, payload staging, and eventual encryption or extortion activity.

How to fix it

Upgrade SolarWinds Web Help Desk to a vendor-supported version containing the fix for CVE-2025-26399 and any superseding hotfixes from SolarWinds. No fixed version was provided in the input, so administrators should verify the current SolarWinds advisory and install the latest Web Help Desk release or hotfix that explicitly addresses CVE-2025-26399, not only the earlier CVE-2024-28986 or CVE-2024-28988 fixes. If immediate patching is not possible, remove Web Help Desk from direct internet exposure, restrict access to trusted administrative networks or VPN, enforce network-layer allowlisting, and monitor or block unauthenticated access to AjaxProxy/Web Help Desk endpoints. Treat mitigations as temporary because this is active RCE with ransomware association. After patching, restart the application service, review for unauthorized files or process activity, rotate credentials stored in or used by Web Help Desk, and investigate the server for signs of compromise before returning it to normal operation.

How to confirm the fix worked

Confirm the installed SolarWinds Web Help Desk build is the vendor-recommended fixed release or later and that the applied hotfix explicitly covers CVE-2025-26399. Validate that externally reachable Web Help Desk instances are no longer accessible from untrusted networks unless business-required and protected by strong access controls. Review HTTP access logs to ensure suspicious unauthenticated requests to AjaxProxy endpoints are no longer accepted after remediation. Use authenticated vulnerability scanning, vendor-provided version checks, software inventory, and configuration management data to confirm every Web Help Desk deployment has been updated. As a negative validation, confirm that the application no longer produces Java deserialization errors, AjaxProxy stack traces, or command-execution side effects when receiving malformed serialized input in an authorized test environment.

Typical attack path

1. Scan the internet or internal network for exposed SolarWinds Web Help Desk services.
2. Fingerprint the application and identify reachable AjaxProxy/Web Help Desk endpoints.
3. Send a crafted unauthenticated deserialization payload to the vulnerable AjaxProxy component.
4. Achieve command execution under the Web Help Desk application service account.
5. Run discovery commands to identify host privileges, operating system, network configuration, users, and accessible file shares.
6. Download or write additional payloads such as web shells, reverse shells, credential tools, or ransomware staging components.
7. Access Web Help Desk configuration files, ticket data, attachments, and stored integration credentials where available.
8. Use harvested credentials or network access to pivot to additional systems.
9. Establish persistence, exfiltrate data, disrupt the help desk service, or deploy ransomware.

How to detect it

To determine whether exploitation already occurred, review SolarWinds Web Help Desk application logs, Tomcat access/catalina logs, reverse proxy/WAF logs, EDR process telemetry, Windows Event Logs or Linux audit logs, file integrity monitoring, and outbound network telemetry. Focus on unauthenticated HTTP requests to AjaxProxy/Web Help Desk endpoints, especially POST requests with unusual binary or base64-encoded serialized Java payloads, large request bodies, abnormal user agents, or responses followed by process creation on the server. Look for Java deserialization artifacts such as ObjectInputStream/readObject exceptions, StreamCorruptedException, InvalidClassException, ClassNotFoundException for gadget-chain classes, or Base64 strings beginning with Java serialization markers. On the endpoint, hunt for child processes spawned by java.exe, tomcat, or the Web Help Desk service, including cmd.exe, powershell.exe, wscript.exe, cscript.exe, bash, sh, curl, wget, certutil, bitsadmin, mshta, rundll32, or suspicious archive/download tools. Review recently created or modified files under Web Help Desk, Tomcat, temporary, upload, and web root directories for JSP web shells, rogue JARs, scripts, loaders, or ransomware staging files. Because this vulnerability is linked to ransomware activity, also hunt for reconnaissance commands, credential dumping, mass file access, backup deletion attempts, suspicious outbound connections, and encryption-related process behavior. Correlate any suspicious AjaxProxy requests with immediate process execution, new files, new services, scheduled tasks, outbound connections, or authentication attempts from the Web Help Desk host.

• AjaxProxy
• /AjaxProxy
• AjaxProxyServlet
• rO0AB
• ac ed 00 05
• java.io.ObjectInputStream
• readObject
• java.io.StreamCorruptedException
• java.io.InvalidClassException
• java.lang.ClassNotFoundException
• application/x-java-serialized-object
• java.exe -> cmd.exe
• java.exe -> powershell.exe
• java.exe -> certutil.exe
• java.exe -> bitsadmin.exe
• java.exe -> mshta.exe
• java.exe -> rundll32.exe
• java.exe -> wscript.exe
• java.exe -> cscript.exe
• tomcat -> cmd.exe
• tomcat -> powershell.exe
• tomcat -> sh
• tomcat -> bash
• tomcat -> curl
• tomcat -> wget
• /usr/local/webhelpdesk/
• C:\Program Files\WebHelpDesk\
• catalina.out
• localhost_access_log
• *.jsp

What your security team should do

• Prioritize this vulnerability as emergency/highest severity because it is unauthenticated RCE, in CISA KEV, actively exploited in the wild, has high EPSS probability, and is associated with ransomware campaigns.
• Immediately identify all SolarWinds Web Help Desk instances, including internet-facing, internal, test, and disaster recovery systems.
• Patch to the latest SolarWinds-supported fixed release or hotfix that explicitly addresses CVE-2025-26399 and supersedes the earlier bypassed fixes.
• Remove Web Help Desk from direct internet exposure or restrict it to trusted networks/VPN while patching and during post-remediation validation.
• Hunt for historical exploitation using web access logs, Tomcat/application logs, EDR telemetry, process creation logs, file-write events, and outbound network connections from the Web Help Desk server.
• Investigate any child processes spawned by Java/Tomcat/Web Help Desk services, especially shell interpreters, scripting engines, file download utilities, and archive tools.
• Review the server for web shells, unauthorized JAR/class files, suspicious scheduled tasks/services, unexpected startup items, and recently modified files in Web Help Desk web or Tomcat directories.
• Rotate credentials and secrets stored in Web Help Desk, used by integrations, or present in support tickets if compromise is suspected.
• Segment the Web Help Desk host from sensitive internal systems and limit outbound connectivity to required destinations only.
• Prepare ransomware response actions if exploitation is suspected, including host isolation, preservation of forensic evidence, credential reset sequencing, and review of backup integrity.