CVE-2025-26399: SolarWinds Web Help Desk Deserialization -- RCE via AjaxProxy

Background

SolarWinds Web Help Desk (WHD) is an IT service management and help desk ticketing platform deployed by enterprises, government agencies, and educational institutions to manage support requests, asset tracking, and SLAs. It is a Java-based web application typically deployed on Windows or Linux servers within corporate networks.

SolarWinds products have been under elevated scrutiny since the 2020 SUNBURST supply chain attack. Web Help Desk itself was previously targeted — CVE-2024-28987 (hardcoded credentials) was exploited by threat actors in 2024. The AjaxProxy component in CVE-2025-26399 is a server-side proxy for AJAX calls, and its deserialization flaw provides a direct path to OS command execution. CISA added this to the KEV catalogue on 2026-03-09.

Technical Mechanism

CVE-2025-26399 is a Java deserialization vulnerability in the AjaxProxy component of SolarWinds Web Help Desk. Java deserialization vulnerabilities are a well-understood attack class in which an application calls ObjectInputStream.readObject() (or similar) on attacker-controlled data without restricting the types that can be instantiated.

The AjaxProxy component acts as a server-side intermediary for asynchronous web requests. If the data it receives and processes includes serialised Java objects, and if those objects are deserialised without type validation, an attacker can supply a malicious serialised payload:

1. The attacker constructs a malicious Java serialised object using a known gadget chain (e.g., Commons Collections, Spring, Groovy gadgets via ysoserial)
2. The serialised payload encodes a Java object graph that, when deserialised, triggers a chain of method calls culminating in Runtime.getRuntime().exec()
3. The attacker delivers this payload to the Web Help Desk AjaxProxy endpoint
4. Web Help Desk deserialises the payload, triggering the gadget chain
5. The OS command executes under the Web Help Desk service context — typically SYSTEM on Windows installations
6. The attacker achieves SYSTEM-level command execution on the WHD server

SYSTEM-level access on a help desk server carries real weight: WHD typically holds credentials for all monitored systems, ticketing data with sensitive IT information, and network connectivity to management interfaces across the organisation.

Real-World Exploitation Evidence

CVE-2025-26399 was added to CISA KEV on 2026-03-09. SolarWinds exploitation follows established patterns:

• Nation-state actors — following SUNBURST, SolarWinds products remain high-profile targets for state-sponsored groups seeking access to IT management infrastructure
• Ransomware operators — help desk servers with broad network access and asset management credentials are valuable for ransomware campaigns; compromising WHD can provide credentials and network maps for a full encryption run
• Prior SolarWinds WHD targeting — CVE-2024-28987 confirmed that threat actors actively focus on this product, and that attention continues
• CISA’s KEV listing reflects confirmed in-the-wild exploitation

Impact Assessment

CVE-2025-26399 grants code execution under the Web Help Desk service context, which on Windows installations is typically SYSTEM — the highest available privilege level. An attacker achieving this can read and exfiltrate all data accessible to the WHD process: this commonly includes service account passwords for every monitored system, LDAP and Active Directory credentials used for directory integration, database connection strings, and the full ticketing history containing sensitive IT information. The unauthenticated 9.8 CVSS score reflects that no credentials are required to trigger the vulnerability via the AjaxProxy endpoint.

The organisational blast radius extends well beyond the WHD server itself. Help desk platforms occupy a privileged position in enterprise networks: they hold credentials for and have network connectivity to monitored systems across the organisation. A WHD compromise with extracted credentials provides the attacker with a pre-built lateral movement toolkit. Government agencies and enterprises using WHD for IT asset management face particular exposure, as the asset inventory and monitoring data can be used to plan further attacks. Ransomware operators have historically valued help desk credential stores because they eliminate the reconnaissance phase — the credentials and system inventory needed to deploy ransomware organisation-wide are already contained in WHD.

Affected Versions

Consult the SolarWinds Security Advisory for precise version ranges.

Remediation Steps

1. Apply SolarWinds’ patch immediately
2. If patching is delayed, restrict access to the Web Help Desk server to trusted internal IP addresses — it should not be internet-accessible
3. Implement a web application firewall rule to block binary/serialised object payloads to AjaxProxy endpoints
4. Rotate all credentials stored in or associated with Web Help Desk:
   • Service account passwords for monitored systems
   • Database credentials
   • LDAP/Active Directory integration credentials
   • Email integration credentials
5. Review WHD audit logs for unexpected configuration changes or access patterns
6. Check the WHD server for new user accounts, scheduled tasks, or unexpected processes running as SYSTEM
7. Audit active directory for signs of lateral movement originating from the WHD service account
8. If compromise is suspected, treat all credentials in WHD as compromised and perform organisation-wide rotation

Detection Guidance

Web Help Desk logs — review for:

• POST requests to AjaxProxy endpoints with binary or base64-encoded payloads
• Requests from unexpected source IP addresses (WHD is typically accessed only from internal networks)
• Error logs showing Java deserialisation exceptions followed by unexpected behaviour

Windows Event Logs (for Windows-hosted WHD):

• Event ID 4688: Process creation by the WHD service (e.g., java.exe spawning cmd.exe or powershell.exe)
• Event ID 4720: New local user account creation
• Event ID 7045: New Windows service installation

SIEM query example (Splunk):

index=windows_events host=solarwinds_whd EventCode=4688
| where ParentProcessName like "%java.exe%"
| where CommandLine like "%cmd.exe%" OR CommandLine like "%powershell%" OR CommandLine like "%curl%"
| stats count by ComputerName, CommandLine, ParentCommandLine
| sort -count

Network monitoring:

• Unexpected outbound connections from the WHD server to external IP addresses
• LDAP authentication events from the WHD service account from unexpected source hosts

Timeline

References

• NVD — CVE-2025-26399
• CISA KEV — CVE-2025-26399
• SolarWinds Security Advisory — CVE-2025-26399