{"id":"CVE-2024-28986","kind":"vulnerability","aliases":["CVE-2024-28986"],"related":[],"title":"SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability…","description":"SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. \n\nWhile it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing.  \n\nHowever, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.","summary":"SolarWinds Web Help Desk has a deserialization flaw that handles untrusted data unsafely. An attacker can send crafted input over the network to run code on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-08-15T00:00:00+00:00","products":[{"name":"SolarWinds Web Help Desk","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"solarwinds web help desk","fixed":[],"affected":"<= 12.8.2","ecosystem":"vendor"},{"name":"solarwinds web help desk","fixed":[],"affected":"= 12.8.3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","self-hosted","solarwinds","web-help-desk"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the mitigations from the vendor's instructions, or stop using the product if no mitigation exists (per CISA required action). Exact fixed version: unknown.","status":"open","published_at":"2024-08-13T23:15:16+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:23+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:58:23Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations from the vendor's instructions, or stop using the product if no mitigation exists (per CISA required action). Exact fixed version: unknown.","reach":"network","impact":"high","summary":"SolarWinds Web Help Desk has a deserialization flaw that handles untrusted data unsafely. An attacker can send crafted input over the network to run code on the server.","category":"infrastructure","who_cares":["solarwinds","web-help-desk","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the help desk server remotely.","analyst_note":"Exploited in the wild per CISA KEV; find the vendor advisory and affected/fixed versions and the exact check for vulnerable installs.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000451,"input_tokens":2821,"output_tokens":338,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':19A,22A '-28986':20A,23A 'abund':129C 'allow':95C 'appli':139C 'attack':60B,97C 'authent':121C 'avail':145C 'caution':131C 'code':15A,70B,88C 'command':100C 'craft':63B 'custom':138C 'cve':18A,21A 'data':57B 'deseri':13A,52B,86C 'desk':4A,27A,31A,35A,45B,49B,77C,137C 'execut':16A,89C 'exploit':36B,93C 'flaw':53B 'found':6A,79C 'handl':55B 'help':3A,26A,30A,34A,44B,48B,76C,136C 'host':40B,103C 'howev':125C 'infrastructur':37B 'input':64B 'java':12A,85C 'machin':104C 'network':67B 'patch':141C 'recommend':133C 'remot':14A,87C 'report':108C 'reproduc':118C 'run':69B,99C 'self':39B 'self-host':38B 'send':62B 'server':73B 'solarwind':1A,41B,46B,74C,113C 'solarwinds':24A,28A,32A 'suscept':9A,82C 'test':124C 'thorough':123C 'unabl':116C 'unauthent':111C 'unsaf':58B 'untrust':56B 'vulner':17A,90C,112C 'web':2A,25A,29A,33A,43B,47B,75C,135C 'web-help-desk':42B 'without':120C 'would':94C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-08-13T23:15:16+00:00","kev":{"dateAdded":"2024-08-15","dueDate":"2024-09-05","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@solarwinds.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-28986","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-28986","severity":null,"published_at":"2024-08-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:15+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-28986","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28986","severity":null,"published_at":"2024-08-13T23:15:16+00:00","modified_at":"2026-06-17T07:22:12+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}