SolarWinds Web Help Desk deserialization (CVE-2025-26399) — what happens when data converted for storage is turned back
A deserialization vulnerability in SolarWinds Web Help Desk. Restoring untrusted data to its original form is described as allowing commands to be run on the host machine. The remediation deadline was set three days after listing.
Key facts
- CVE IDCVE-2025-26399
- Affected (vendor / product)SolarWinds Web Help Desk
- CWECWE-502
- ExploitationListed in CISA KEV (exploitation confirmed); also confirmed used in ransomware
- Remediation due2026-03-12 (U.S. federal civilian agencies, BOD 22-01)
Key points
- The affected product is SolarWinds Web Help Desk, classified as CWE-502, deserialization of untrusted data.
- A component of the product is described as allowing commands to be run on the host machine.
- Deserialization restores data converted for storage or transmission, and what runs during that rebuilding depends on the content.
- The class is qualified as untrusted data because the problem lies in how the trustworthiness of the source is handled, not in the processing itself.
- Added March 9, 2026 with a due date of March 12, three days later; use in ransomware campaigns is known.
1Serializing and restoring
Data a program works with has an involved structure in memory. Saving it to a file or sending it over a network requires converting it into a single sequence. That conversion is serialization, and turning it back into the original structure on receipt is deserialization.
- 1SerializationA structure in memory is converted into a sequence that can be stored or sent
- 2Storing or sendingWritten to a file, or sent over a network
- 3DeserializationThe receiving side rebuilds the original structure from the sequence
- 4Where trouble arisesWhen what was received is trusted while being rebuilt
Rebuilding follows the content of the data received, and what runs during that rebuilding is determined by that content. Restoring data received from an untrusted party therefore risks running processing that was never intended.
2Why the class is qualified
The qualifier in the class name follows from that difference. Deserialization is everyday work; the problem lies in how the trustworthiness of the source is handled.
3Three days
Three days is far short of the standard 21. Of the entries this site holds as of 2026-09-03, 130 carry a deadline of a week or less, of which three days is the most common at 91. A short deadline means there is no room to plan an update.
4When support systems are the target
The product is a help desk system. Systems of this kind connect broadly across an organization to receive enquiries and often hold information about users and assets. This site separately covers a vulnerability in remote support software, and the same shape recurs: tools placed there to support and operate become targets precisely because of how widely they connect.
Why it matters
Systems placed there to support and operate connect broadly and hold information, so the reach of any compromise is wide. A three-day deadline leaves almost no room to plan an update.
FAQ
What is deserialization?
Why is it dangerous?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).