SolarWinds has issued an urgent hotfix for a severe security flaw in its Web Help Desk software that could allow attackers to execute malicious code remotely without any authentication required.
## The Vulnerability Details
The newly discovered vulnerability, designated **CVE-2025-26399**, represents SolarWinds’ third attempt to fix a persistent security issue that has plagued their Web Help Desk platform. This latest flaw affects version 12.8.7 and stems from unsafe data handling in the AjaxProxy component.
What makes this vulnerability particularly concerning is its history. CVE-2025-26399 is actually a bypass of two previous patches:
– CVE-2024-28988 (second patch attempt)
– CVE-2024-28986 (original vulnerability)
The original flaw was so serious that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to their Known Exploited Vulnerabilities catalog in August 2024, indicating active exploitation by threat actors.
## Impact and Risk
Web Help Desk is widely used by medium and large organizations for:
– IT support ticket management
– Workflow automation
– Asset management
– Compliance monitoring
A successful attack could give cybercriminals complete control over the affected system, potentially leading to data theft, system compromise, or network infiltration.
## Immediate Action Required
SolarWinds has released a hotfix exclusively through their Customer Portal. Organizations using Web Help Desk must:
1. **Stop the Web Help Desk service**
2. **Navigate to the installation directory**: `
3. **Back up and remove**: `c3p0.jar`
4. **Back up existing files**: `whd-core.jar`, `whd-web.jar`, `whd-persistence.jar`
5. **Install hotfix files**: Replace the backed-up files and add `HikariCP.jar`
6. **Restart Web Help Desk**
## Current Threat Status
While there are no public reports of CVE-2025-26399 being exploited yet, the vulnerability was discovered through Trend Micro’s Zero Day Initiative. Given the history of the related vulnerabilities being actively exploited, security experts recommend immediate patching.
This incident highlights the ongoing challenges in cybersecurity, where initial patches sometimes fail to completely address underlying security issues, requiring multiple remediation attempts.
Organizations using SolarWinds Web Help Desk should prioritize applying this hotfix immediately to protect against potential attacks.