{"history":[{"alert":0,"cve":"CVE-2025-26399","id":22872,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.90564, \"percentile\": 0.99805}"},{"alert":0,"cve":"CVE-2025-26399","id":20492,"kind":"epss","observed_at":1794327601,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.90564, \"percentile\": 0.99804}"},{"alert":0,"cve":"CVE-2025-26399","id":18461,"kind":"epss","observed_at":1794241201,"payload":"{\"date\": \"2026-11-09\", \"epss\": 0.90564, \"percentile\": 0.99803}"},{"alert":0,"cve":"CVE-2025-26399","id":16525,"kind":"epss","observed_at":1794154800,"payload":"{\"date\": \"2026-11-08\", \"epss\": 0.90564, \"percentile\": 0.99803}"},{"alert":0,"cve":"CVE-2025-26399","id":14503,"kind":"epss","observed_at":1794068402,"payload":"{\"date\": \"2026-11-07\", \"epss\": 0.90564, \"percentile\": 0.99803}"},{"alert":0,"cve":"CVE-2025-26399","id":12285,"kind":"epss","observed_at":1793982001,"payload":"{\"date\": \"2026-11-06\", \"epss\": 0.90564, \"percentile\": 0.99803}"},{"alert":0,"cve":"CVE-2025-26399","id":10271,"kind":"epss","observed_at":1793938800,"payload":"{\"date\": \"2026-11-05\", \"epss\": 0.90564, \"percentile\": 0.99803}"},{"alert":0,"cve":"CVE-2025-26399","id":7820,"kind":"epss","observed_at":1793809200,"payload":"{\"date\": \"2026-11-04\", \"epss\": 0.90564, \"percentile\": 0.99803}"},{"alert":0,"cve":"CVE-2025-26399","id":5597,"kind":"epss","observed_at":1793722800,"payload":"{\"date\": \"2026-11-03\", \"epss\": 0.90564, \"percentile\": 0.99802}"},{"alert":1,"cve":"CVE-2025-26399","id":4061,"kind":"cna","observed_at":1793722800,"payload":"{\"containers\": {\"adp\": [{\"metrics\": [{\"other\": {\"content\": {\"id\": \"CVE-2025-26399\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"role\": \"CISA Coordinator\", \"timestamp\": \"2025-09-23T00:00:00+00:00\", \"version\": \"2.0.3\"}, \"type\": \"ssvc\"}}, {\"other\": {\"content\": {\"dateAdded\": \"2026-03-09\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399\"}, \"type\": \"kev\"}}], \"providerMetadata\": {\"dateUpdated\": \"2026-08-04T03:55:57.668Z\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\"}, \"references\": [{\"tags\": [\"third-party-advisory\"], \"url\": \"https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/\"}, {\"tags\": [\"government-resource\"], \"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-03-09T00:00:00.000Z\", \"value\": \"CVE-2025-26399 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"Web Help Desk\", \"vendor\": \"SolarWinds\", \"versions\": [{\"status\": \"affected\", \"version\": \"12.8.7 and below\"}]}], \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"user\": \"00000000-0000-4000-9000-000000000000\", \"value\": \"Anonymous working with Trend Micro Zero Day Initiative\"}], \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.\"}], \"value\": \"SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.\"}], \"impacts\": [{\"capecId\": \"CAPEC-248\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-248: Untrusted Execution Flow\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-502\", \"description\": \"CWE-502: Deserialization of Untrusted Data\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2025-09-23T05:07:14.702Z\", \"orgId\": \"49f11609-934d-4621-84e6-e02e032104d6\", \"shortName\": \"SolarWinds\"}, \"references\": [{\"url\": \"https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399\"}, {\"url\": \"https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm\"}], \"solutions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"SolarWinds recommends customers to upgrade to Web Help Desk version 12.8.7 HF1 as soon as is practical.\"}], \"value\": \"SolarWinds recommends customers to upgrade to Web Help Desk version 12.8.7 HF1 as soon as is practical.\"}], \"source\": {\"discovery\": \"EXTERNAL\"}, \"title\": \"SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability\", \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}}}, \"cveMetadata\": {\"assignerOrgId\": \"49f11609-934d-4621-84e6-e02e032104d6\", \"assignerShortName\": \"SolarWinds\", \"cveId\": \"CVE-2025-26399\", \"datePublished\": \"2025-09-23T05:07:14.702Z\", \"dateReserved\": \"2025-02-08T00:19:09.395Z\", \"dateUpdated\": \"2026-08-04T03:55:57.668Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"},{"alert":0,"cve":"CVE-2025-26399","id":3379,"kind":"epss","observed_at":1793665375,"payload":"{\"date\": \"2026-11-02\", \"epss\": 0.90564, \"percentile\": 0.99801}"},{"alert":1,"cve":"CVE-2025-26399","id":229,"kind":"kev","observed_at":1793665375,"payload":"{\"cveID\": \"CVE-2025-26399\", \"cwes\": [\"CWE-502\"], \"dateAdded\": \"2026-03-09\", \"dueDate\": \"2026-03-12\", \"forensicTriage\": \"No\", \"knownRansomwareCampaignUse\": \"Known\", \"notes\": \"https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399 ; https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm ; https://nvd.nist.gov/vuln/detail/CVE-2025-26399\", \"product\": \"Web Help Desk\", \"requiredAction\": \"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.\", \"shortDescription\": \"SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.\", \"vendorProject\": \"SolarWinds\", \"vulnerabilityName\": \"SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability\"}"}],"record":{"affected":[{"defaultStatus":"unaffected","product":"Web Help Desk","vendor":"SolarWinds","versions":[{"status":"affected","version":"12.8.7 and below"}]}],"cna":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-26399","options":[{"Exploitation":"active"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-09-23T00:00:00+00:00","version":"2.0.3"},"type":"ssvc"}},{"other":{"content":{"dateAdded":"2026-03-09","reference":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399"},"type":"kev"}}],"providerMetadata":{"dateUpdated":"2026-08-04T03:55:57.668Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["third-party-advisory"],"url":"https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/"},{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399"}],"timeline":[{"lang":"en","time":"2026-03-09T00:00:00.000Z","value":"CVE-2025-26399 added to CISA KEV"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Web Help Desk","vendor":"SolarWinds","versions":[{"status":"affected","version":"12.8.7 and below"}]}],"credits":[{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"Anonymous working with Trend Micro Zero Day Initiative"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986."}],"value":"SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986."}],"impacts":[{"capecId":"CAPEC-248","descriptions":[{"lang":"en","value":"CAPEC-248: Untrusted Execution Flow"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-502","description":"CWE-502: Deserialization of Untrusted Data","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-09-23T05:07:14.702Z","orgId":"49f11609-934d-4621-84e6-e02e032104d6","shortName":"SolarWinds"},"references":[{"url":"https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399"},{"url":"https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"SolarWinds recommends customers to upgrade to Web Help Desk version 12.8.7 HF1 as soon as is practical."}],"value":"SolarWinds recommends customers to upgrade to Web Help Desk version 12.8.7 HF1 as soon as is practical."}],"source":{"discovery":"EXTERNAL"},"title":"SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability","x_generator":{"engine":"Vulnogram 0.1.0-dev"}}},"cveMetadata":{"assignerOrgId":"49f11609-934d-4621-84e6-e02e032104d6","assignerShortName":"SolarWinds","cveId":"CVE-2025-26399","datePublished":"2025-09-23T05:07:14.702Z","dateReserved":"2025-02-08T00:19:09.395Z","dateUpdated":"2026-08-04T03:55:57.668Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794154800,"cve":"CVE-2025-26399","description":"SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.","epss":{"date":"2026-11-12","epss":0.90564,"percentile":0.99805},"epss_checked":1794522003,"first_seen":1793665375,"kev":{"cveID":"CVE-2025-26399","cwes":["CWE-502"],"dateAdded":"2026-03-09","dueDate":"2026-03-12","forensicTriage":"No","knownRansomwareCampaignUse":"Known","notes":"https://www.solarwinds.com/trust-center/security-advisories/cve-2025-26399 ; https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm ; https://nvd.nist.gov/vuln/detail/CVE-2025-26399","product":"Web Help Desk","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","shortDescription":"SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine.","vendorProject":"SolarWinds","vulnerabilityName":"SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability"},"kev_checked":1794522003,"products":"SolarWinds Web Help Desk","references":["https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26399","https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_12-8-7-hotfix-1_release_notes.htm","https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-26399"],"score":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","provider":"SolarWinds","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"SolarWinds recommends customers to upgrade to Web Help Desk version 12.8.7 HF1 as soon as is practical.","state":"PUBLISHED","title":"SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability","updated_at":1794500401,"workarounds":""},"sources":[]}