Critical severity9.8CISA KEVNVD Advisory· Published Aug 13, 2024· Updated Jun 17, 2026
CVE-2024-28986
CVE-2024-28986
Description
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine.
While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing.
However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:*range: <=12.8.2
- cpe:2.3:a:solarwinds:web_help_desk:12.8.3:-:*:*:*:*:*:*
- (no CPE)range: previous versions
Patches
Vulnerability mechanics
References
3- support.solarwinds.com/SuccessCenter/s/article/WHD-12-8-3-Hotfix-1nvdBroken LinkVendor Advisory
- www.solarwinds.com/trust-center/security-advisories/CVE-2024-28986nvdVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
2- 16th March – Threat Intelligence ReportCheck Point Research · Mar 16, 2026
- Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s))watchTowr Labs · Feb 25, 2026