CVE-2024-28986: SolarWinds Web Help Desk Java deserialization remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityCritical CVSS 9.8 RCE in an internet-facing product, listed in CISA KEV with a very high EPSS score, warrants immediate patching.

What it is

SolarWinds Web Help Desk contains a Java deserialization flaw (CWE-502) that allows remote code execution on the host. The vendor originally reported it as unauthenticated but could not reproduce exploitation without authentication, so the true pre-auth reachability is uncertain. It matters because a critical-severity RCE in a help desk product exposes the host and any data it handles.

Impact

An attacker who can reach the vulnerable deserialization path can execute arbitrary commands on the host machine, leading to full compromise of the Web Help Desk server.

Attack surface

The CVSS vector is network-reachable with no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), but the vendor states it could not reproduce the issue without authentication, so the practical requirement for credentials is unresolved.

Exploitation

It is listed in CISA KEV (added 2024-08-15) and has a very high EPSS 30-day probability of 0.846 (99.7th percentile), indicating active exploitation is expected or observed. No ransomware campaign use is documented in the record.

What to do

• Apply the SolarWinds Web Help Desk 12.8.3 Hotfix 1 patch or later vendor fix immediately.
• If patching cannot be done at once, follow CISA KEV required action: apply vendor mitigations or discontinue use of the product.
• Restrict network access to the Web Help Desk service to trusted management networks and block it from the public internet.
• Rotate credentials and secrets stored or used by the Web Help Desk host after patching, in case of prior compromise.
• Monitor the vendor advisory page for updated guidance, since the original hotfix link is flagged as broken.

Detection

• Hunt for unexpected child processes spawned by the Web Help Desk Java process (for example shells, curl, wget, or scripting interpreters).
• Monitor for outbound network connections from the Web Help Desk host to unfamiliar external addresses.
• Review Web Help Desk and host logs for deserialization errors, unusual request payloads, or anomalous POST traffic around the time of suspected exploitation.
• Alert on new or modified files, scheduled tasks, or services on the Web Help Desk host that do not match a known baseline.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.