CVE DatabaseCVE-2024-28986

Updated 2026-06-17한국어 권고문 →

CVE-2024-289869.8/CRITICALCISA KEVCWE-502

SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability (CVE-2024-28986) Technical Advisory

⚡ Jump to Patch

Affected Vendors

solarwinds

Affected Components

web help desk

Published Date

2024-08-13

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

84.6%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

SolarWinds Web Help Desk (WHD) 12.8.3 and all prior versions

Impact

Successful exploitation allows remote attackers to execute arbitrary commands on the host machine via unsafe Java deserialization, potentially leading to full system compromise

Mitigation

Immediately apply the official SolarWinds Web Help Desk 12.8.3 Hotfix 1 or upgrade to the latest patched version

Affected Products & Version Scope

SolarWinds Web Help Desk versions 12.8.3 and earlier (without Hotfix 1)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the official 12.8.3 Hotfix 1 patch provided by SolarWinds. Below is an example of stopping the service and applying the patch on a Linux host.

bash

# 1. Stop the Web Help Desk service
sudo service webhelpdesk stop

# 2. Extract the hotfix files to the installation directory
tar -zxvf whd-12.8.3-hotfix1.tar.gz -C /opt/webhelpdesk/

# 3. Restart the service and verify status
sudo service webhelpdesk start
sudo service webhelpdesk status

2. Temporary Workaround & Hardening Configuration

If patching cannot be performed immediately, restrict access to the Web Help Desk port (default 8081/443) using a reverse proxy or firewall to allow only trusted internal IP ranges.

nginx

# Nginx configuration to restrict access to trusted subnets only
server {
    listen 443 ssl;
    server_name whd.internal.local;

    location / {
        allow 10.0.0.0/8;
        allow 192.168.0.0/16;
        deny all;
        
        proxy_pass http://127.0.0.1:8081;
        proxy_set_header Host $host;
    }
}

3. Log Audit & IoC Verification Commands

Inspect the Web Help Desk logs for indicators of compromise, such as unexpected Java deserialization errors or suspicious class loading attempts.

bash

# Search for deserialization exceptions and common payload signatures in WHD logs
grep -ri 'ObjectInputStream' /usr/local/webhelpdesk/logs/
grep -ri 'java.lang.Runtime.getRuntime' /usr/local/webhelpdesk/logs/

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

This vulnerability is actively exploited in the wild (CISA KEV); immediately apply SolarWinds WHD 12.8.3 Hotfix 1 to secure your environment.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2024-28986) is a critical Java Deserialization vulnerability (CWE-502) residing in SolarWinds Web Help Desk (WHD). The root cause lies in the application's unsafe deserialization of untrusted user-supplied data. When the application processes a specially crafted serialized Java object, it executes arbitrary code within the context of the Web Help Desk process without proper validation.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by sending a malicious serialized Java object to an exposed Web Help Desk endpoint. By leveraging existing gadget chains (such as vulnerable libraries in the classpath), the attacker triggers arbitrary OS command execution. Although initially reported as an unauthenticated vulnerability, vendor testing reproduced it with authentication. However, due to its active exploitation in the wild, it has been added to the CISA KEV catalog, making immediate remediation imperative.

3. Infrastructure & Business Impact

Successful exploitation grants the attacker remote code execution (RCE) capabilities on the underlying host machine. This can lead to complete compromise of the help desk server, unauthorized access to sensitive customer support tickets, lateral movement within the internal network, data exfiltration, and potential deployment of ransomware, causing severe operational disruption.

Official Vendor Advisories & References

NVD Original English Description

SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing. However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.

https://support.solarwinds.com/SuccessCenter/s/article/WHD-12-8-3-Hotfix-1

Source: psirt@solarwinds.com · Broken Link, Vendor Advisory

https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28986

Source: psirt@solarwinds.com · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28986

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2024-28986)

FAQ

Q1. How critical is CVE-2024-28986 and is it actively exploited in the wild?

CVE-2024-28986 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 84.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2024-28986?

Primary impacted vendors include solarwinds across web help desk. Scope summary: SolarWinds Web Help Desk versions 12.8.3 and earlier (without Hotfix 1)

Q3. What temporary mitigations or workarounds exist for CVE-2024-28986 before patching?

[Mitigation] Immediately apply the official SolarWinds Web Help Desk 12.8.3 Hotfix 1 or upgrade to the latest patched version Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION