Vulnerability Report

Critical SolarWinds Vulnerability Actively Exploited

By

Matthew Fagan, Vulnerability Management Patch Analyst

By

Access Point Consulting

A critical vulnerability reported under active exploitation has been added to CISA’s known exploited vulnerabilities catalog.  This vulnerability is categorized as CVE-2024-28986 (CVSSv3.1: 9.8) and affects SolarWinds Web Help Desk. It is defined as a Java Deserialization Remote Code Execution which if exploited would allow an attacker to run commands on the host machine.

Impact

SolarWinds Web Help Desk 12.8.3 and all previous versions are affected.

This vulnerability is defined as requiring no authentication, but SolarWinds has reported that they have done thorough testing and could not reproduce the bug without authentication. They are still urging Web Help Desk customers to apply the now-available patch as reported in the advisory on 8/9/2024.

This vulnerability has a high CVSS score, there are reports of active exploitation, and it allows for remote code execution. It would have a high impact if exploited and presents an elevated risk due to reports of active exploitation in the wild.

Remediation

Upgrading to SolarWinds Web Help Desk 12.8.3 HF 1 will remediate this vulnerability. Review the documentation for Web Help Desk to ensure a proper upgrade.

Recommendations

Patch: We advise you to follow the steps listed in the update documentation linked above and update SolarWinds Web Help Desk to the latest version.

Review documentation: Ensure you are reviewing and following the steps outlined in vendor documentation regarding vulnerability remediation, application upgrades, and mitigations.

Assess scope and plan: Use vulnerability scanning tools to assess the scope of this vulnerability throughout your environment and get all associated parties together to create a plan to patch the associated software.

Associated Bulletins

SolarWinds Trust Center Security Advisories | CVE-2024-28986

Resources

Latest Resources

Resources

CyberWatch

April 2, 2025

Scott "Monty" Montgomery (Island) | Navigating CMMC compliance for organizations of every size

Scott Montgomery, known as Monty, joined the CyberWatch Expert Series podcast to discuss his extensive background in cybersecurity, particularly in building and designing network security tools for high-assurance environments like the Department of Defense (DoD) and the intelligence community. His experience includes significant tenure at McAfee (now Trellix), which led him to his current role at Island, where he focuses on innovative approaches to cybersecurity compliance.

Find out more
March 19, 2025

Michael Sviben (DomainGuard) | Defending against phishing and building proactive security awareness

Cybersecurity threats evolve rapidly, and one tactic consistently rises above the rest: phishing. In this episode of CyberWatch, Michael Sviben, co-founder of DomainGuard, discusses why phishing remains so effective, how businesses and individuals become targets, and what you can do to stay vigilant.

Find out more
March 5, 2025

David Habib (Brightspot) | Building a culture of cybersecurity awareness

Cybersecurity awareness is often reduced to check-the-box training, but David Habib, CIO at Brightspot, argues that real security awareness isn’t about formal programs—it’s about making security part of a company’s culture. In this episode, he shares practical insights on how organizations can move beyond stale training sessions to create an engaged and security-conscious workforce.

Find out more