Request a Demo

CVE-2025-26399

Critical

Emerging Threat · 23 Sep 2025

Understand Your Exposure: SolarWinds (CVE-⁠2025-⁠26399).

At a glance

  • Unauthenticated AjaxProxy deserialization RCE (CWE-502) in SolarWinds Web Help Desk 12.8.7 and earlier
  • CVSS v3.1 9.8 (SolarWinds and NVD): Critical
  • Added to CISA KEV on 9 Mar 2026 (due 12 Mar 2026) with known ransomware campaign use
  • Fixed in Web Help Desk 12.8.7 Hotfix 1; SolarWinds advisory published 17 Sep 2025
  • Bypasses the earlier fixes for CVE-2024-28986 and CVE-2024-28988, so those hotfixes alone do not close it

We can rapidly deploy the zero-install watchTowr Platform to determine if your organization is affected, before in-the-wild exploitation begins.

The watchTowr Platform is trusted within the world’s most targeted industries, to help protect their attack surfaces.

CVSS

9.8 (v3.1)

Exploitation

In The Wild

CISA KEV

Listed

Vendor patch

Available

watchTowr check

Live

Rapid support

Find Out If You’re Affected

We onboard from outside, assess your exposure to this CVE, and come back with a validated answer, not a maybe.

Zero install · no infrastructure changes

Deployed and assessing within hours

How we answer it

Hour 0

You give us a domain. Nothing to install, no infrastructure change.

Hours

We reconstruct your external estate and locate every exposed instance an attacker could reach.

Same Day

You get a validated answer on exposure, and mitigation options if you cannot patch immediately.

What Teams Ask Us First?

Any SolarWinds Web Help Desk installation on 12.8.7 or earlier without Hotfix 1 is affected, including servers already patched for CVE-2024-28986 and CVE-2024-28988. Check the WHD version and hotfix level in the administration console and whether the instance is reachable from the internet.
CISA added CVE-2025-26399 to its Known Exploited Vulnerabilities catalog on 9 March 2026 with a 12 March deadline and records known ransomware campaign use, so treat internet-facing instances as actively targeted.
Apply Web Help Desk 12.8.7 Hotfix 1 (or a later release that includes it) following SolarWinds’ advisory, keep WHD off the public internet where possible, and review instances that were exposed unpatched for signs of compromise. watchTowr can validate your exposure from outside, with nothing to install.
Attackers Don't Give Up. Neither Should Your Security Testing.

Zero install. No infrastructure changes. Uplift your security posture within hours of onboarding the watchTowr Platform.

Get Continuous Testing
Talk to our team
PHP2Shell Remote Code Execution FAQ

Frequently asked questions about PHP2Shell CVE-2026-109618 and CVE-2026-109619

Read The FAQ
Find Out What an Attacker Can Reach Before They Do.

Point us at a domain. We reconstruct your real external estate and come back with validated exposure, not a theoretical CVE list.

Request a Demo
See the Platform
Disclosure to Exploitation Is Four Hours. Patching Is Not.

The watchTowr Platform validates your exposure to an emerging threat and mitigates it at the edge while the vendor patch is still in testing.

Get Continuous Testing
How the Platform works
We Find the Vulnerabilities. You Hear It From Us First.

watchTowr Labs publishes what is being exploited right now and whether it touches your estate, not vendor summaries written a week late.

Read the Research
Talk to our team
Your Exposure Changes Weekly. Annual Testing Cannot Describe It.

Continuous, fully external validation of what an attacker can actually exploit against your estate, at a 0.01% false-positive rate.

Get Continuous Testing
Read the case studies
See the Estate You Own, Including What No Asset List Holds.

Subsidiaries, forgotten infrastructure, shadow IT. We rebuild your external surface from a single domain, then validate what is exposed.

Request a Demo
Explore use cases