PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-26399 SolarWinds CVE debrief

CVE-2025-26399 is a SolarWinds Web Help Desk deserialization of untrusted data vulnerability that CISA has added to its Known Exploited Vulnerabilities catalog. Because it is officially flagged as known exploited, organizations should treat it as an urgent remediation item and follow the vendor guidance referenced by CISA.

Vendor
SolarWinds
Product
Web Help Desk
CVSS
CRITICAL 9.8
CISA KEV
Listed
Original CVE published
2026-03-09
Original CVE updated
2026-03-09
Advisory published
2026-03-09
Advisory updated
2026-03-09

Who should care

Organizations that run SolarWinds Web Help Desk, especially teams responsible for patching, application security, and incident response. This is also important for asset owners who need to confirm whether the product is in use and whether mitigations or updates have been applied.

Technical summary

The issue is described as a deserialization of untrusted data vulnerability in SolarWinds Web Help Desk. CISA identifies it as actively exploited and links to the SolarWinds security advisory, related Web Help Desk release notes, and the NVD record. No CVSS score was provided in the supplied source corpus.

Defensive priority

Urgent

Recommended defensive actions

  • Review the SolarWinds security advisory referenced by CISA for CVE-2025-26399 and apply the vendor-recommended mitigations or updates.
  • If mitigations are unavailable, discontinue use of the product as directed by CISA.
  • For cloud services where applicable, follow BOD 22-01 guidance and verify that any required compensating controls are in place.
  • Confirm whether SolarWinds Web Help Desk is deployed anywhere in your environment, including test or secondary instances.
  • Prioritize validation of remediation status before the CISA due date associated with this KEV entry.

Evidence notes

CISA’s Known Exploited Vulnerabilities catalog lists CVE-2025-26399 for SolarWinds Web Help Desk with dateAdded 2026-03-09 and dueDate 2026-03-12. The supplied CISA metadata states the required action is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA also cites the SolarWinds advisory, Web Help Desk release notes, and the NVD detail page as supporting references.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-26399 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-26399

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-26399 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-26399

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.