CVE-2024-28986criticalunder attackCWE-502

CVE-2024-28986: critical vulnerability in SolarWinds Web Help Desk

SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability

Published · Updated

Follow this CVE+ Monitor Web Help Desk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

95Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 85%
from disclosure to weapon
Published on NVDAug 13
CISA KEV+2d
Action required by CISAfederal deadline: 2024-09-05

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

SolarWinds Web Help Desk has a critical flaw where untrusted Java data can be processed in a way that lets attackers run commands directly on the server. This is a serious risk because it bypasses normal security checks.

Technical detail

Java deserialization vulnerability (CWE-502) in SolarWinds Web Help Desk allows remote code execution through malicious serialized objects. While authentication requirements may limit exposure, the vulnerability enables arbitrary command execution on the host system with CVSS 9.8 severity.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing.   However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
SolarWinds · Web Help Desk
Related CVEs — SolarWinds Web Help Desk

In the same product, most dangerous first.

CVE-2024-28987CRITICALSolarWinds Web Help Desk Hardcoded Credential VulnerabilityEPSS 93.3%KEVCVE-2025-26399CRITICALSolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation VulnerabilityEPSS 90.6%KEVCVE-2025-40551CRITICALSolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 84.2%KEVCVE-2025-40536HIGHSolarWinds Web Help Desk Security Control Bypass VulnerabilityEPSS 73.6%KEVCVE-2025-40553CRITICALSolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 68.0%CVE-2025-40554CRITICALSolarWinds Web Help Desk Authentication Bypass VulnerabilityEPSS 60.6%