CVE-2024-28987

SolarWinds Web Help Desk

Published 21 Aug 2024 · updated 17 Jun 2026 · Analyzed

9.1 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 15 Oct 2024, with a remediation deadline of 5 Nov 2024 for US federal agencies.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.

References

support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2 · Release Notes
www.solarwinds.com/trust-center/security-advisories/cve-2024-28987 · Vendor Advisory
www.theregister.com/2024/08/22/hardcoded_credentials_bug_solarwinds_whd/ · Press/Media Coverage, Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28987 · US Government Resource