{"cve":"CVE-2024-28986","nvd":{"published":"2024-08-13T23:15:16.627","modified":"2026-06-17T07:22:12.443","status":"Analyzed","description":"SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. \n\nWhile it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing.  \n\nHowever, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-502"],"references":["https://support.solarwinds.com/SuccessCenter/s/article/WHD-12-8-3-Hotfix-1","https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28986","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28986"],"products":["solarwinds:web_help_desk"],"source":"nvd","synced_at":"2026-10-19T21:53:51.317825789+00:00"},"epss":{"cve":"CVE-2024-28986","score":0.84628,"percentile":0.99704,"date":"2026-11-01"},"kev":{"cve":"CVE-2024-28986","date_added":"2024-08-15","due_date":"2024-09-05","vendor":"SolarWinds","product":"Web Help Desk","known_ransomware":false},"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}