TI-2024-19177 Aliases CVE-2024-28988 GHSA-3mr8-x6wp-2wc6

SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability

HIGH 71CWE-502Published 2025-09-01 · Updated 2026-02-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability was found by the ZDI team after researching a previous vulnerability and providing this report. The ZDI team was able to discover an unauthenticated attack during their research. We recommend all Web Help Desk customers apply the patch, which is now available. We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.41744 98th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
SolarWinds	Web Help Desk	12.8.3 HF 2 and previous versions and later	—	No fix listed	CNA

Web Help Desk VendorSolarWinds Affected 12.8.3 HF 2 and previous versions and later Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:solarwinds:web_help_desk::::::::	up to 12.8.2	Vulnerable	SolarWinds
cpe:2.3:a:solarwinds:web_help_desk:12.8.3:-::::::	12.8.3	Vulnerable	SolarWinds
cpe:2.3:a:solarwinds:web_help_desk:12.8.3:hotfix1::::::	12.8.3 hotfix1	Vulnerable	SolarWinds
cpe:2.3:a:solarwinds:web_help_desk:12.8.3:hotfix2::::::	12.8.3 hotfix2	Vulnerable	SolarWinds

cpe:2.3:a:solarwinds:web_help_desk:*:*:*:*:*:*:*:* Versions up to 12.8.2 Vulnerable ·SolarWinds
cpe:2.3:a:solarwinds:web_help_desk:12.8.3:-:*:*:*:*:*:* Versions 12.8.3 Vulnerable ·SolarWinds
cpe:2.3:a:solarwinds:web_help_desk:12.8.3:hotfix1:*:*:*:*:*:* Versions 12.8.3 hotfix1 Vulnerable ·SolarWinds
cpe:2.3:a:solarwinds:web_help_desk:12.8.3:hotfix2:*:*:*:*:*:* Versions 12.8.3 hotfix2 Vulnerable ·SolarWinds

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-28988
2026-10-03 Alias added: GHSA-3mr8-x6wp-2wc6

References

Patch 1

https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28988

Other 1

https://support.solarwinds.com/SuccessCenter/s/article/WHD-12-8-3-Hotfix-3

TI-2025-27044 SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-27034 SolarWinds Web Help Desk Security Control Bypass Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-19358 SolarWinds Web Help Desk Deserialization of Untrusted Data Privilege Escalation Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2024-19175 SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2024-19176 SolarWinds Web Help Desk Hardcoded Credential Vulnerability KEVCVSS 3.1CRITICAL 9.1
TI-2025-27046 SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences