CVE coverage
View on NVD →
CVE-2025-26399
CVSS 9.8
Actively exploited (KEV)
4 detections found
SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Potential Traffic Tunneling using QEMU | production | 2026-09-18 |
| elastic | RMM Software Installation from a Commonly Abused Web Service | production | 2026-09-18 |
| elastic | Suspicious Shell Execution via Velociraptor | production | 2026-09-18 |
| sigma | Suspicious Child Process of SolarWinds WebHelpDesk | experimental | 2026-02-11 |