Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2025-26399 SolarWinds Web Help Desk Overview and Takeaways

netspi.com | vulnerability | CVE-2025-26399 | #rce | #deserialization | #patching | #solarwinds | #cisa-kev | #web-help-desk | #cve-2025-26399

Summary

CVE-2025-26399 is a critical unauthenticated deserialization flaw (CVSS 9.8) in SolarWinds Web Help Desk, a patch bypass now actively exploited and listed in CISA's KEV catalog.
CVE
CVE-2025-26399
Published
Collected

original ↗

Related coverage

vulnerability · bishopfox.com
Master Key Included: Detecting SolarWinds ARM CVE-2026-28326
CVE-2026-28326 is an unauthenticated RCE in SolarWinds ARM where a hardcoded shared secret on TCP 55555 leads to SYSTEM-level code execution. Patch now.
vulnerability · netspi.com
CVE-2024-28989: Weak Encryption Key Management in Solar Winds Web Help Desk
CVE-2024-28989: SolarWinds Web Help Desk uses predictable AES-GCM keys—some static, some from a restricted keyspace—so an attacker with a backup file can recover stored passwords. Fixed in 12.8.5.
vulnerability · bishopfox.com
Signature Optional - Analysis of CVE-2026-28323
CVE-2026-28323 is a CVSS 9.8 SAML auth bypass in SolarWinds Web Help Desk. A single forged POST request grants unauthenticated access to any valid account.
vulnerability · netspi.com
CVE-2026-20127 – Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Overview & Takeaways
CVE-2026-20127 is a CVSS 10.0 authentication bypass in Cisco Catalyst SD-WAN Controller and Manager that lets unauthenticated attackers gain admin access; exploitation is confirmed in the wild.
vulnerability · netspi.com
CVE-2026-1731 – BeyondTrust RCE Overview and Takeaways
Learn about CVE-2026-1731, a critical RCE vulnerability in BeyondTrust RS & PRA products. Discover its impact, affected versions, and remediation steps.
vulnerability · portswigger.net
Pre-auth RCE in ForgeRock OpenAM (CVE-2021-35464)
A pre-auth RCE in ForgeRock OpenAM via unsafe deserialization in its Jato framework: the jato.pageSession parameter accepted Java objects exploitable with a custom ysoserial chain (CVE-2021-35464).
back