Ethical Hacking News
SolarWinds Releases Hotfix for Critical Remote Code Execution Flaw
A critical hotfix has been released by SolarWinds to address a severe vulnerability in its Web Help Desk software that can allow attackers to execute arbitrary commands on susceptible systems. The vulnerability, tracked as CVE-2025-26399 (CVSS score: 9.8), is an instance of deserialization of untrusted data that can result in code execution. Learn more about this critical flaw and the steps being taken by SolarWinds to address it.
SolarWinds Web Help Desk 12.8.7 and all previous versions are affected by a critical deserialization of untrusted data vulnerability (CVE-2025-26399, CVSS score: 9.8).The vulnerability allows remote attackers to execute arbitrary code on affected installations without authentication.The vulnerability is a patch bypass for CVE-2024-28988 and CVE-2024-28986, previously addressed by SolarWinds in August 2024.A hotfix (HF1) has been released for SolarWinds Web Help Desk 12.8.7 to address the vulnerability.Organizations are advised to update their instances to the latest version to ensure security and conduct regular vulnerability assessments.
SolarWinds has recently released a critical hotfix to address a severe vulnerability in its Web Help Desk software, which could allow attackers to execute arbitrary commands on susceptible systems. The vulnerability, tracked as CVE-2025-26399 (CVSS score: 9.8), is an instance of deserialization of untrusted data that can result in code execution.
The SolarWinds Web Help Desk 12.8.7 and all previous versions are affected by this critical flaw, which was discovered by an anonymous researcher working with the Trend Micro Zero Day Initiative (ZDI). The vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Web Help Desk without requiring authentication.
The CVE-2025-26399 vulnerability is a patch bypass for CVE-2024-28988 (CVSS score: 9.8), which in turn is a bypass for CVE-2024-28986 (CVSS score: 9.8). The latter vulnerability was originally addressed by the company back in August 2024.
"SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine," SolarWinds said in an advisory released on September 17, 2025. This means that even without authentication, attackers can execute arbitrary code on affected systems.
The discovery of this critical flaw comes as no surprise to experts, given the history of similar vulnerabilities discovered by researchers working with Trend Micro Zero Day Initiative. In 2020, a similar vulnerability was discovered in SolarWinds software that allowed months-long access into multiple Western government agencies. This incident left a lasting mark on the industry and highlighted the need for constant vigilance against such threats.
The latest vulnerability has been added to the Known Exploited Vulnerabilities (KEV) catalog by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). However, there is currently no information publicly available on the nature of attacks that may be weaponizing this bug.
In response to this critical flaw, SolarWinds has released a hotfix for SolarWinds Web Help Desk 12.8.7 HF1, which provides optimal protection against this vulnerability. It is recommended that users update their instances to the latest version to ensure the security of their systems.
"This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Web Help Desk. Authentication is not required to exploit this vulnerability," according to a ZDI advisory for CVE-2024-28988. The lack of authentication makes it easier for attackers to exploit this flaw, highlighting the need for vigilance and timely patching.
The discovery of this critical vulnerability serves as a reminder of the importance of constant monitoring and patching of software systems. It is essential for organizations to stay up-to-date with the latest security patches and to conduct regular vulnerability assessments to identify potential threats before they become exploited.
In conclusion, the release of the SolarWinds hotfix for CVE-2025-26399 highlights the ongoing need for vigilance against critical vulnerabilities in software systems. As experts pointed out, this is the third time that this particular flaw has been discovered and patched, with the original bug being actively exploited in the wild. It remains to be seen whether this latest patch will prevent future exploitation, but it underscores the importance of timely patching and vulnerability assessment.
Related Information:
https://www.ethicalhackingnews.com/articles/SolarWinds-Releases-Hotfix-for-Critical-Remote-Code-Execution-Flaw-ehn.shtml
https://thehackernews.com/2025/09/solarwinds-releases-hotfix-for-critical.html
https://cybersecuritynews.com/solarwinds-web-help-desk-vulnerability/
https://nvd.nist.gov/vuln/detail/CVE-2025-26399
https://www.cvedetails.com/cve/CVE-2025-26399/
https://nvd.nist.gov/vuln/detail/CVE-2024-28988
https://www.cvedetails.com/cve/CVE-2024-28988/
https://nvd.nist.gov/vuln/detail/CVE-2024-28986
https://www.cvedetails.com/cve/CVE-2024-28986/
Published: Tue Sep 23 08:38:11 2025 by llama3.2 3B Q4_K_M
