Post

SolarWinds Releases Hotfix for Critical CVE-2025-26399 Remote Code Execution Flaw

Posted
By ictsec.pl
1 min read

SolarWinds has released hot fixes to address a critical security flaw impacting its Web Help Desk software that, if successfully exploited, could allow attackers to execute arbitrary commands on susceptible systems.

The vulnerability, tracked as CVE-2025-26399 (CVSS score: 9.8), has been described as an instance of deserialization of untrusted data that could result in code execution. It affects SolarWinds Web Help Desk 12.8.7 and all previous versions.

SolarWinds said CVE-2025-26399 is a patch bypass for CVE-2024-28988 (CVSS score: 9.8), which, in turn, is a bypass for CVE-2024-28986 (CVSS score: 9.8) that was originally addressed by the company back in August 2024.

That said, it’s worth emphasizing that the original bug CVE-2024-28986 was added to the Known Exploited Vulnerabilities (KEV) catalog by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) shortly after public disclosure.

To read the complete article, see: The Hacker News

😊

SECURITY
CVE-2025-26399 SOLARWINDS HOTFIX CYBERSECURITY
This post is licensed under CC BY 4.0 by the author.