Live › vulnerability › CVE-2024-28986
Go to dashboardSolarWinds Web Help Desk has a deserialization flaw that handles untrusted data unsafely. An attacker can send crafted input over the network to run code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| SolarWinds Web Help Desk | vendor | – | – |
| solarwinds web help desk | vendor | <= 12.8.2 | – |
| solarwinds web help desk | vendor | = 12.8.3 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine.
While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing.
However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.
This page as .md · .json · in your agent: get_signal("CVE-2024-28986")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.