CVE-2024-28986—SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Vulnerability Name

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

Description

SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could allow for remote code execution.

Known To Be Used in Ransomware Campaigns?

Ransomware Status:

Unknown

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes

• https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28986
• https://nvd.nist.gov/vuln/detail/CVE-2024-28986

Related News Articles

• SolarWinds Fixes Four Critical Web Help Desk Flaws With Unauthenticated RCE and Auth BypassJanuary 29, 2026
• SolarWinds fixes critical Web Help Desk RCE vulnerabilities, upgrade ASAP!January 29, 2026
• SolarWinds warns of critical Web Help Desk RCE, auth bypass flawsJanuary 28, 2026
• SolarWinds fixes critical Web Help Desk RCE vulnerability (CVE-2025-26399)September 24, 2025
• SolarWinds Releases Hotfix for Critical CVE-2025-26399 Remote Code Execution FlawSeptember 23, 2025

Related Weaknesses

• CWE-502