CVE-2024-28986
CRITICAL KEV NUCLEISolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization
Title source: nucleiDescription
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing. However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.
Nuclei Templates (1)
SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization
CRITICALVERIFIEDby rxerium
Shodan:
http.favicon.hash:"1895809524"
References (3)
Scores
CVSS v3
9.8
EPSS
0.7843
EPSS Percentile
99.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Intel
CISA KEV
2024-08-15
VulnCheck KEV
2024-08-15
InTheWild.io
2024-08-15
ENISA EUVD
EUVD-2024-26048
Classification
CWE
CWE-502
Status
published
Affected Products (2)
solarwinds/web_help_desk
< 12.8.2
solarwinds/web_help_desk
Timeline
Published
Aug 13, 2024
KEV Added
Aug 15, 2024
Tracked Since
Feb 18, 2026