All news with #java deserialization tag

Tue, September 23, 2025

SolarWinds Patches Third Bypass for Web Help Desk Bug

#SolarWinds #Security Advisory #Patch #Active Exploitation #RCE #Java Deserialization

🔒SolarWinds has issued a third patch for a critical Java deserialization vulnerability in its Web Help Desk product. The vendor describes the new advisory as a patch bypass of CVE-2024-28988, which itself bypassed CVE-2024-28986, and has designated the latest issue CVE-2025-26399. The underlying unsafe Java deserialization flaw in the AjaxProxy component can permit unauthenticated remote code execution and is rated 9.8/10 on the CVSS scale.