Critical SolarWinds Web Help Desk Vulnerability Enables Privilege Escalation

SolarWinds has issued an urgent security advisory regarding a critical remote code execution (RCE) vulnerability in its Web Help Desk (WHD) platform, warning customers of an actively exploitable flaw that could allow unauthenticated attackers to gain complete control over affected systems.

The vulnerability, CVE-2025-26399, has been assigned a CVSS severity score of 9.8 (Critical), underscoring the seriousness of the threat. Security researchers have identified the root cause as insecure deserialization within the AjaxProxy component, a recurring weakness in the WHD software stack.