PlatformPlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
high·Product Based Web Vulnerabilities·Updated Dec 31, 2025

SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsurl
CostFree
2.4k
Times Used
continuous scan runs
0
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
🔴
CISA Known Exploited Vulnerability
This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.
CVECVE-2024-28986
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.

SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing.   However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
Web Help Deskby SolarWinds
previous versions
webhelpdeskby solarwinds
0
Updated Sep 9, 2026View on NVD →
Similar Tools
critical
SolarWinds Web Help Desk < 2026.1 - Unauthenticated JNDI Injection RCE
→high
SolarWinds Web Help Desk < 12.8.8 Hotfix 1 (HF1) - Security Control Bypass
→medium
LearnPress < 4.3.0 - Arbitrary Callback Execution to Information Exposure
→medium
AKHQ Dashboard - Unauthenticated Access
→medium
SeaweedFS Filer - Unauthenticated Access
→medium
Trino Cluster Overview - Unauthenticated Dashboard Exposure
→high
Unauth Supervisor Dashboard - Detect
→high
Twonky Server 8.5.2 on Linux and Windows - Log File Exposure
→

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.

SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization Scanner | S4E