What’s Vulnerable › Vulnerabilities

CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2024-10-15
• EPSS: 93.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-08-21 · updated 2026-06-17
• Weakness: CWE-798

Description

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.

Affected products

• SolarWinds Web Help Desk: before 12.8.3; 12.8.3, 12.8.3-hotfix1 — fixed in 12.8.3

How to fix

Upgrade to a fixed version: SolarWinds Web Help Desk 12.8.3. Check the vendor advisory for mitigations.

References

• https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2
• https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987
• https://www.theregister.com/2024/08/22/hardcoded_credentials_bug_solarwinds_whd/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28987

Get alerted when CVE-2024-28987 or the next vulnerability affects your stack