CVE-2025-26399: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

This vulnerability, tracked as CVE-2025-26399, affects SolarWinds Web Help Desk. It stems from a deserialization of untrusted data weakness that could allow an attacker to execute commands on the host system. The issue is located in the AjaxProxy component. Organizations that rely on this product for IT support ticket handling should treat it as a remote code execution risk until confirmed otherwise through official channels.

How it works

The weakness is categorized as CWE-502, deserialization of untrusted data. In this class of flaw, an application accepts serialized input without sufficient validation and reconstructs objects from that input.

An attacker can supply crafted serialized data to the AjaxProxy component. When the application deserializes the data, it may result in unintended code execution on the underlying host. Specific mechanics of exploitation, affected code paths, and required preconditions must be confirmed against the vendor advisory.

Am I affected? How to find it in your systems

SolarWinds Web Help Desk is typically deployed as an on-premises or self-hosted application used by IT teams to manage service requests. Inventory all instances by checking server deployments, container images, and configuration management databases for the product name.

• Review installed software lists and application directories on Windows and Linux servers that host help-desk functions.
• Examine web server configurations and proxy settings that route traffic to AjaxProxy endpoints.
• Check application logs for unusual deserialization activity or unexpected process spawns originating from the help-desk service; exact indicators should be validated against vendor guidance.
• Confirm exact versions and configurations against the vendor advisory, as public detail on affected builds is limited.

How to remediate

Apply the vendor-supplied update referenced in the official advisory as the primary remediation step. Follow the installation and verification instructions provided by the vendor.

• After patching, review and restrict network access to the Web Help Desk instance to only authorized management networks.
• Disable or remove any unused AjaxProxy functionality if the vendor advisory indicates this is safe for your deployment.
• Re-test service accounts and authentication settings to ensure they follow least-privilege principles.

If you can't patch immediately

Until a patch can be applied, implement network segmentation to isolate the Web Help Desk server from broader internal networks and the internet. Consider virtual patching through a web application firewall that can inspect and block malformed serialized payloads targeting the affected component.

• Monitor inbound traffic to AjaxProxy endpoints for anomalous request patterns and alert on unexpected command execution indicators.
• If mitigations cannot be applied, follow the vendor instructions or discontinue use of the product as noted in CISA guidance.
• Apply any applicable BOD 22-01 requirements if the instance is exposed as a cloud service.

If your data may have been exposed

Deserialization vulnerabilities that permit remote code execution have been used to establish persistent access in past incidents. Run a free exposure scan of your organization's email domains against known breach data to identify any related account compromises.