SolarWinds Fixes Four Critical Web Help Desk Flaws With Unauthenticated RCE and Auth Bypass

SolarWinds Web Help Desk is susceptible to a Java deserialization of untrusted data flaw (CWE-502) in which maliciously crafted serialized Java data sent to the application can trigger remote code execution on the host machine. The flaw is rated 9.8 (network vector, no privileges or user interaction required), though SolarWinds has been unable to reproduce exploitation without authentication after thorough testing and recommends patching all deployments out of caution. A successful attacker gains the ability to run arbitrary commands on the Web Help Desk server, typically yielding control of the host and access to help-desk data. All Web Help Desk versions are potentially affected, and SolarWinds has released a hotfix/patch to address the issue. The bug is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-08-15, ordered federal agencies to patch by a Friday deadline, and EPSS estimates an 84.6% probability of exploitation within 30 days (100th percentile).

Do: Upgrade every Web Help Desk deployment to the patched release per SolarWinds' security advisory (a hotfix addressing the issue in all versions is available); if immediate patching is not possible, restrict network access to the Web Help Desk web interface and watch the host for signs of command execution. Federal agencies must meet the CISA KEV remediation deadline, and defenders should also review SolarWinds' related Web Help Desk advisories (including the separately fixed hardcoded-credential issue) while patching.

SolarWinds Web Help Desk (WHD) contains hard-coded credentials (CWE-798): fixed, built-in authentication material embedded in the shipped software. Because the same credentials exist on every WHD installation, a remote attacker who knows them can authenticate to WHD without any user account, with no privileges or user interaction required (CVSS 3.1 9.1, AV:N/AC:L/PR:N/UI:N). Successful use grants access to internal WHD functionality and the ability to modify data, with high confidentiality and integrity impact but no availability impact. Any organization running an unpatched WHD instance is affected, particularly internet-exposed deployments such as those operated by managed service providers and enterprise IT service desks. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-10-15 (ransomware use not yet reported), EPSS assigns a 93.2% probability of exploitation within 30 days (100th percentile), and no public proof-of-concept was known at the time of this record.

Do: Upgrade all WHD instances to the patched SolarWinds release that includes the October 2024 fix for CVE-2024-28987 (check the SolarWinds PSIRT advisory for the exact fixed version, e.g., WHD 12.8.4 or later); the required KEV action applies, and U.S. federal agencies must remediate by November 5, 2024. Prioritize internet-exposed WHD servers: restrict network access to the help desk interface/API until patched and review logs for unauthenticated access using built-in credentials, since exploitation is confirmed in the wild. If patching is not possible, apply mitigations per vendor instructions or discontinue use of the product, as CISA recommends.

CVE-2024-28988 is a Java deserialization remote code execution flaw (CWE-502) in SolarWinds Web Help Desk that allows an attacker to run commands on the host machine running the application. It is triggered over the network by sending the application crafted input that is deserialized without adequate validation, and requires no authentication or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N). Successful exploitation gives remote code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 9.8, critical). All Web Help Desk deployments running versions prior to the vendor's hotfix are affected; the flaw was discovered by the Trend Micro Zero Day Initiative (ZDI) team, which found it exploitable without authentication while researching a previously reported Web Help Desk vulnerability. As of this analysis there is no confirmed in-the-wild exploitation, no CISA KEV listing, and no known public PoC, but EPSS assigns a ~39.4% probability of exploitation within 30 days (99th percentile), so defenders should treat it as a high-priority patch.

Do: Apply the hotfix SolarWinds has released for Web Help Desk immediately, per the vendor's advisory, since all customers are urged to patch. If patching is delayed, restrict network access to the Web Help Desk server — especially remove direct internet exposure — and monitor for unexpected command or child-process activity from the Web Help Desk service. Also inventory which of your instances are internet-facing and review their access logs for unauthenticated, suspicious requests.

SolarWinds Web Help Desk contains an unauthenticated deserialization of untrusted data vulnerability (CWE-502) in its AjaxProxy component that allows remote attackers to run arbitrary commands on the host machine without any credentials or user interaction. It is triggered by sending a crafted request to the AjaxProxy endpoint of an affected Web Help Desk installation. Successful exploitation yields full code execution on the server, and the flaw is known to be used in ransomware campaigns. Any organization running SolarWinds Web Help Desk is affected, including installations already patched for the earlier CVE-2024-28988 and CVE-2024-28986, since this flaw is a patch bypass of both. The flaw carries a very high exploitation probability (EPSS ~89.5%) and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-09 with known ransomware use.

Do: Immediately apply SolarWinds' hotfix for CVE-2025-26399 per the vendor's instructions — organizations that previously patched CVE-2024-28988 or CVE-2024-28986 must apply the new hotfix because those patches do not close this flaw. If the hotfix cannot be applied right away, restrict network access to Web Help Desk (firewall/VPN, limit exposure of the service to the internet) and discontinue use if mitigations are unavailable, per CISA KEV/BOD 22-01 guidance. Given known ransomware use, review Web Help Desk hosts for signs of compromise, including unexpected process execution and accounts or data accessed via the server.

SolarWinds Web Help Desk contains a deserialization of untrusted data flaw (CWE-502) that allows an unauthenticated attacker to reach the vulnerable functionality over the network and have it deserialize attacker-supplied input. By sending crafted serialized data, the attacker triggers remote code execution and can run arbitrary commands on the host machine running Web Help Desk. Successful compromise grants control of the help desk server, and observed intrusions include attackers installing Zoho agents and Velociraptor for post-exploitation. Any organization running the product is affected, particularly instances exposed to the internet; the flaw carries a CVSS 9.8 (critical) score and federal agencies are under a CISA (BOD 22-01) patching deadline. The vulnerability is being actively exploited in the wild and was added to the CISA KEV catalog on 2026-02-03, with an EPSS probability of 83.6% that it will be exploited within 30 days.

Do: Upgrade Web Help Desk to the latest patched release per the SolarWinds security advisory (the source data does not specify a fixed version number), and follow BOD 22-01 mitigations or discontinue use if mitigation is not possible, noting the federal patching deadline. Until patched, restrict internet-facing access to the Web Help Desk server. Check hosts for post-exploitation artifacts reported in the wild, such as unexpected Zoho agent installations and Velociraptor, and review logs for unauthenticated requests targeting the application.