SolarWinds · Web Help Desk
CVE-2024-28987
SolarWinds Web Help Desk Hardcoded Credential Vulnerability
What it is
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
CISA: SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: November 5, 2024
More exploited flaws from SolarWinds
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 9, 2026 | Deserialization of Untrusted Data | Web Help Desk | Critical 9.8 | 90% |
| Feb 12, 2026 | Security Control Bypass | Web Help Desk | High 8.1 | 74% |
| Feb 3, 2026 | Deserialization of Untrusted Data | Web Help Desk | Critical 9.8 | 84% |
| Aug 15, 2024 | Deserialization of Untrusted Data | Web Help Desk | Critical 9.8 | 85% |
| Jun 5, 2026 | Uncontrolled Resource Consumption | Serv-U | High 7.5 | 44% |
| Jul 17, 2024 | Path Traversal Vulnerability | Serv-U | High 8.6 | 99.6% |
| Jan 21, 2022 | Improper Input Validation | Serv-U | Medium 4.3 | 3.5% |
| Nov 3, 2021 | Privilege Escalation | Virtualization Manager | High 7.8 | 3.7% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.