Actively exploited in the wild
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
SolarWinds - Web Help Desk · Listed in the CISA KEV since 2024-08-15. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-28986
CriticalCVSS 9.8KEVSummary
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing.
Risk Assessment
Potential remote code execution could lead to full system compromise, even if authentication is required.
Recommendation
Apply the available patch, as recommended by SolarWinds, to protect against potential exploitation.
Other vulnerabilities in SolarWinds Web Help Desk
See all- CVE-2026-28323Critical
SolarWinds Web Help Desk is affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled.
- CVE-2024-28987CriticalActively exploited
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
- CVE-2026-28299High
SolarWinds Web Help Desk is affected by a denial-of-service vulnerability that can cause the server to crash due to insufficient memory.
Original NVD description (English source)
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing. However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.