SolarWinds fixes critical Web Help Desk RCE vulnerabilities, upgrade ASAP!

SolarWinds Web Help Desk is susceptible to a Java deserialization of untrusted data flaw (CWE-502) in which maliciously crafted serialized Java data sent to the application can trigger remote code execution on the host machine. The flaw is rated 9.8 (network vector, no privileges or user interaction required), though SolarWinds has been unable to reproduce exploitation without authentication after thorough testing and recommends patching all deployments out of caution. A successful attacker gains the ability to run arbitrary commands on the Web Help Desk server, typically yielding control of the host and access to help-desk data. All Web Help Desk versions are potentially affected, and SolarWinds has released a hotfix/patch to address the issue. The bug is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-08-15, ordered federal agencies to patch by a Friday deadline, and EPSS estimates an 84.6% probability of exploitation within 30 days (100th percentile).

Do: Upgrade every Web Help Desk deployment to the patched release per SolarWinds' security advisory (a hotfix addressing the issue in all versions is available); if immediate patching is not possible, restrict network access to the Web Help Desk web interface and watch the host for signs of command execution. Federal agencies must meet the CISA KEV remediation deadline, and defenders should also review SolarWinds' related Web Help Desk advisories (including the separately fixed hardcoded-credential issue) while patching.

SolarWinds Web Help Desk (WHD) contains hard-coded credentials (CWE-798): fixed, built-in authentication material embedded in the shipped software. Because the same credentials exist on every WHD installation, a remote attacker who knows them can authenticate to WHD without any user account, with no privileges or user interaction required (CVSS 3.1 9.1, AV:N/AC:L/PR:N/UI:N). Successful use grants access to internal WHD functionality and the ability to modify data, with high confidentiality and integrity impact but no availability impact. Any organization running an unpatched WHD instance is affected, particularly internet-exposed deployments such as those operated by managed service providers and enterprise IT service desks. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-10-15 (ransomware use not yet reported), EPSS assigns a 93.2% probability of exploitation within 30 days (100th percentile), and no public proof-of-concept was known at the time of this record.

Do: Upgrade all WHD instances to the patched SolarWinds release that includes the October 2024 fix for CVE-2024-28987 (check the SolarWinds PSIRT advisory for the exact fixed version, e.g., WHD 12.8.4 or later); the required KEV action applies, and U.S. federal agencies must remediate by November 5, 2024. Prioritize internet-exposed WHD servers: restrict network access to the help desk interface/API until patched and review logs for unauthenticated access using built-in credentials, since exploitation is confirmed in the wild. If patching is not possible, apply mitigations per vendor instructions or discontinue use of the product, as CISA recommends.

SolarWinds Web Help Desk contains a deserialization of untrusted data flaw (CWE-502) that allows an unauthenticated attacker to reach the vulnerable functionality over the network and have it deserialize attacker-supplied input. By sending crafted serialized data, the attacker triggers remote code execution and can run arbitrary commands on the host machine running Web Help Desk. Successful compromise grants control of the help desk server, and observed intrusions include attackers installing Zoho agents and Velociraptor for post-exploitation. Any organization running the product is affected, particularly instances exposed to the internet; the flaw carries a CVSS 9.8 (critical) score and federal agencies are under a CISA (BOD 22-01) patching deadline. The vulnerability is being actively exploited in the wild and was added to the CISA KEV catalog on 2026-02-03, with an EPSS probability of 83.6% that it will be exploited within 30 days.

Do: Upgrade Web Help Desk to the latest patched release per the SolarWinds security advisory (the source data does not specify a fixed version number), and follow BOD 22-01 mitigations or discontinue use if mitigation is not possible, noting the federal patching deadline. Until patched, restrict internet-facing access to the Web Help Desk server. Check hosts for post-exploitation artifacts reported in the wild, such as unexpected Zoho agent installations and Velociraptor, and review logs for unauthenticated requests targeting the application.