SolarWinds Web Help Desk CVE-2024-28987: Hardcoded Login

What to do

1. Find every Web Help Desk server and record its version from the admin console.
2. Upgrade anything below 2026.1, following SolarWinds' path through 2026.1 to 2026.2.1 (Linux installs need a migration).
3. Restrict the WHD web interface to internal networks or a VPN.
4. If a vulnerable build was reachable, search access logs for OrionTickets requests from unknown addresses.
5. Rotate any password, API key or service account credential that appears in ticket text.

How to check if you are affected or compromised

• Search C:\Program Files\WebHelpDesk\Logs\whd_access_log.*.log for requests to OrionTickets paths, especially bulk listing from addresses you do not recognize.
• Compare ticket edit history for changes no technician made, such as altered notes, links or attachments.
• Review tickets for secrets (reset passwords, shared accounts) that could have been read, and check those accounts for logins after the exposure window.

What happened#

In August 2024, SolarWinds disclosed CVE-2024-28987 in Web Help Desk (WHD), its on-premises IT ticketing product. The advisory calls it a hardcoded credential that lets a "remote unauthenticated user to access internal functionality and modify data." It affects 12.8.3 HF1 and all earlier versions, and the fix is 12.8.3 Hotfix 2. NVD scores it 9.1.

Zach Hanley of Horizon3.ai found it while studying CVE-2024-28986, a Java deserialization flaw in WHD disclosed on August 13 and fixed in Hotfix 1. Horizon3's September 25 write-up published the account name and password baked into the code. It showed they unlock the /OrionTickets API, which lacks the localhost-only restriction many other WHD controllers have. With them, an attacker can "remotely read and modify all help desk ticket details," which often hold "passwords from reset requests and shared service account credentials." Horizon3 notes this does not compromise the WHD server itself, but the stolen secrets make lateral movement easy.

CISA added the CVE to KEV on October 15, 2024, three weeks after the public proof of concept. Per The Hacker News, CISA cited "evidence of active exploitation" but has not said who was exploiting it or what prompted the listing.

Who is affected#

Self-hosted WHD 12.8.3 HF1 and earlier, per the advisory and the CVE record. Note the trap: Hotfix 1, the fix for CVE-2024-28986, is itself vulnerable to this bug. The version floor has since moved well past Hotfix 2. WHD 2026.1 (January 28, 2026) fixed six more SolarWinds CVEs, including another hardcoded credential flaw (CVE-2025-40537) and unauthenticated deserialization RCE (CVE-2025-40551), which CISA added to KEV in February 2026. The current release is 2026.2.1 (July 30, 2026).

Do you really need to act?#

If you run WHD on 2026.1 or later, this CVE is closed. If you run anything older, yes: the credentials are public, the attack is a few HTTP requests, and the later bugs are worse. Exposure matters most. A help desk reachable from the internet is the realistic target. One reachable only from the internal network still leaks tickets to anyone already inside.

What to do now#

1. List every WHD server and its version from the admin console.
2. Upgrade to 2026.1, verify it works, then go to 2026.2.1, as SolarWinds' release notes require. Linux installs cannot upgrade in place to 2026.2.1 and need a migration.
3. Check reachability from outside, for example curl -skI https://helpdesk.example.com/helpdesk/ from an external host, and move the interface behind a VPN.
4. Search logs on Windows with Select-String -Path "C:\Program Files\WebHelpDesk\Logs\whd_access_log.*.log" -Pattern "OrionTickets".
5. Rotate any credential that ever appeared in a ticket.

How to tell if you were hit#

Horizon3 points to C:\Program Files\WebHelpDesk\Logs\whd_access_log.<YYYY-MM-DD>.log. Look for an unrecognized IP address calling the OrionTickets endpoints, especially bulk listing followed by single-ticket reads. Then check ticket history for edits no technician made, since the bug allows writes. Search ticket text for passwords and keys, and review those accounts for logins from new places after the exposure window.

Timeline#

• Aug 13, 2024 — SolarWinds discloses CVE-2024-28986; Hotfix 1 follows.
• Aug 21, 2024 — SolarWinds releases 12.8.3 Hotfix 2 for CVE-2024-28987, and the CVE is published.
• Sep 25, 2024 — Horizon3.ai publishes technical details and the hardcoded credentials.
• Oct 15, 2024 — CISA adds CVE-2024-28987 to KEV; the federal deadline is November 5, 2024.
• Jan 28, 2026 — WHD 2026.1 fixes six further critical and high-severity bugs.
• Jul 30, 2026 — WHD 2026.2.1 becomes the current release.

Vulnerability records

• CVE-2024-28987 · KEV 2024-10-15 · The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. SolarWinds — Web Help Desk Hardcoded Credential Vulnerability (CVE-2024-28987) solarwinds.com
2. SolarWinds — Web Help Desk 2026.1 release notes documentation.solarwinds.com
3. SolarWinds — Web Help Desk 2026.2.1 release notes documentation.solarwinds.com
4. CVE record — CVE-2024-28987 cve.org
5. NVD — CVE-2024-28987 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2024-28987 cisa.gov
7. Horizon3.ai — CVE-2024-28987: SolarWinds Web Help Desk hardcoded credential vulnerability deep-dive horizon3.ai

Coverage and analysis

1. The Hacker News — CISA warns of active exploitation in SolarWinds Help Desk software vulnerability thehackernews.com