DaystoPatch

SolarWindsExploited incident

SolarWinds Web Help Desk AjaxProxy Deserialization of Untrusted Data Remote Code Execution Vulnerability

CVE-2025-26399Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 9 Mar 2026

  • Exploited after a fix existed
  • Known ransomware use
FixedFixed for every supported version 6 days after the first public report.

Response

Silence
same day
First public report to first vendor statement
Exposure
6d
First public report to first fix
Follow-through
6d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    SolarWinds advisory CVE-2025-26399ClaimedQuote verified

    Advisory Detail Severity Critical Advisory ID CVE-2025-26399 First Published 09/17/2025 Fixed Version SolarWinds Web Help Desk 12.8.7 HF1 CVSS Score CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Download PDF Send an Email

    The vendor's own disclosure.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f78ff985d99ecfa5…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    BleepingComputer (Bill Toulas, September 23, 2025)CuratedQuote verified23 Sep 2025

    SolarWinds has released a hotfix for a critical a critical vulnerability in Web Help Desk that allows remote code execution (RCE) without authentication.

    Byline 'September 23, 2025 09:41 AM' (time zone not shown). First public report we found; ZDI's advisory and the earliest Wayback captures of SolarWinds' advisory and release notes are also from 2025-09-23.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:0aa5b8def79f9538…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-26399ClaimedQuote verified23 Sep 2025, 05:07 UTC

    SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:37e5c50cab5dbbd1…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet23 Sep 2025, 05:24 UTC

    You can now share your thoughts on vulnerability CVE-2025-26399 in Vulnerability-Lookup:

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet23 Sep 2025, 14:00 UTC

    next on the hit list? https:// thedefendopsdiaries.com/solarw inds-web-help-desk-faces-third-critical-rce-vulnerability-cve-2025-26399/ # solarwinds # cve202526399 # remotecodeexecution # vulnerability # patchmanagement

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-26399)ClaimedQuote verified9 Mar 2026

    SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

    Added to CISA's KEV catalog on 2026-03-09.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    SolarWinds advisory CVE-2025-26399ClaimedQuote verified

    Advisory Detail Severity Critical Advisory ID CVE-2025-26399 First Published 09/17/2025 Fixed Version SolarWinds Web Help Desk 12.8.7 HF1 CVSS Score CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Download PDF Send an Email

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f78ff985d99ecfa5…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    SolarWinds security advisory CVE-2025-26399 (earliest Wayback capture, 2025-09-23 13:29 UTC)CuratedQuote verified23 Sep 2025

    This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.

    Day of the earliest public capture. The page's own field reads 'First Published 09/17/2025', but no capture, index page, news report or ZDI advisory shows it public before 2025-09-23, and the fixed build was released on 2025-09-23 (see notes).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:e75ab1d207563b66…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date only+6d

    SolarWinds Web Help Desk 12.8.7 Hotfix 1 release notesCuratedQuote verified

    Release date: September 23, 2025

    R2: first publicly downloadable fixed build (12.8.7 HF1).

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:357ad734a93cebc3…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    SolarWinds advisory CVE-2025-26399ClaimedQuote verified17 Sep 2025

    First Published 09/17/2025

    advisory published with fixed version: SolarWinds Web Help Desk 12.8.7 HF1

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:93406985b9b68df2…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date only+6d

    SolarWinds Web Help Desk 12.8.7 Hotfix 1 release notesCuratedQuote verified

    Release date: September 23, 2025

    Single supported line (12.8.7); the hotfix covers it.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:357ad734a93cebc3…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • SolarWinds Web Help Desk
How we built this timeline

CORRECTION PASS 23 Oct 2026 (R2): moments now all date to 23 Sep 2025. The advisory's 'First Published 09/17/2025' field was previously used for world, vendor and First fix, but the hotfix release notes give 'Release date: September 23, 2025', and every public trace (earliest Wayback captures of the advisory and release notes, ZDI's advisory, BleepingComputer's report) is from 23 Sep 2025; we treat 09/17 as an internal date and record it here only.

Reviewers: if a public copy from 17 Sep 2025..22 turns up, add it as a vendor/First public report candidate. Third patch in a bypass chain (CVE-2024-28986 -> CVE-2024-28988 -> CVE-2025-26399).

Exploitation came months after the fix: Microsoft (reported Feb 2026, via The Hacker News Feb 09, 2026: https://thehackernews.com/2026/02/solarwinds-web-help-desk-exploited-for.html) saw December 2025 intrusions on WHD hosts vulnerable to CVE-2025-40551, CVE-2025-40536 and this CVE and could not tell which was used. Kept separate from solarwinds-cve-2025-40551 because it has its own advisory and a fix four months earlier;

KEV marks ransomware use as Known.

Related

SolarWinds report card