CVE-2024-28986 kev in the critical feed json
SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability
published 2024-08-13 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-26048
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Exploited
- added 2024-08-15
- epss
- 84.6%
- EPSS 84.6% chance of exploitation in 30 days, percentile 99.7%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine.
While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing.
However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.
Patch / fix
cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Timeline
- Published
- Added to CISA KEV
- CISA SSVC: exploitation active
- CISA patch deadline
Known exploited
- Added
- 2 y ago
- Patch by
- 2024-09-05 (2 y ago)
- Ransomware
- Not known
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- SolarWinds, Web Help Desk
- CISA name
- SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
84.63% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- SolarWinds Web Help Desk
- solarwinds webhelpdesk
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
solarwinds.com
/trust-center/security-advisories/CVE-2024-28986
vendor-advisory
-
support.solarwinds.com
/SuccessCenter/s/article/WHD-12-8-3-Hotfix-1
broken-link, vendor-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28986
government-resource, us-government-resource
Sources
- CVE List CVE-2024-28986
- NVD CVE-2024-28986
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.