---
title: "SolarWinds Web Help Desk CVE-2024-28987: Hardcoded Login"
url: https://erroneo.us/security/briefs/solarwinds-web-help-desk-cve-2024-28987-hardcoded-credentials/
description: "A built-in account in Web Help Desk 12.8.3 HF1 and earlier lets anyone read and edit every ticket. Fixed in HF2; use 2026.1 or later as the floor."
type: security-brief
section: "Security Digest"
date_published: 2024-08-21
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-28987"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# SolarWinds Web Help Desk CVE-2024-28987: Hardcoded Login

**Verdict: Check exposure.** Any Web Help Desk still on 12.8.3 HF1 or earlier hands its tickets, and the passwords inside them, to anyone; upgrade to a 2026 release, which also closes later exploited bugs.

- **Who must act:** Organizations running SolarWinds Web Help Desk 12.8.3 HF1 or earlier, and anyone still below 2026.1, especially with the web interface reachable from the internet.
- **Who can relax:** Teams already on Web Help Desk 2026.1 or later (2026.2.1 is current) whose tickets were never exposed on a vulnerable build.
- **Affected:** SolarWinds Web Help Desk 12.8.3 HF1 and all previous versions
- **Fixed:** Web Help Desk 12.8.3 Hotfix 2 (Aug 21, 2024); Web Help Desk 2026.1 (Jan 28, 2026) or later, which also fixes later critical bugs; Current release: Web Help Desk 2026.2.1 (Jul 30, 2026)
- **CVEs:** CVE-2024-28987
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find every Web Help Desk server and record its version from the admin console.
2. Upgrade anything below 2026.1, following SolarWinds' path through 2026.1 to 2026.2.1 (Linux installs need a migration).
3. Restrict the WHD web interface to internal networks or a VPN.
4. If a vulnerable build was reachable, search access logs for OrionTickets requests from unknown addresses.
5. Rotate any password, API key or service account credential that appears in ticket text.

### How to check if you are affected

- Search C:\Program Files\WebHelpDesk\Logs\whd_access_log.*.log for requests to OrionTickets paths, especially bulk listing from addresses you do not recognize.
- Compare ticket edit history for changes no technician made, such as altered notes, links or attachments.
- Review tickets for secrets (reset passwords, shared accounts) that could have been read, and check those accounts for logins after the exposure window.

## What happened

In August 2024, SolarWinds disclosed CVE-2024-28987 in Web Help Desk (WHD), its on-premises IT ticketing product. The [advisory](https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987) calls it a hardcoded credential that lets a "remote unauthenticated user to access internal functionality and modify data." It affects 12.8.3 HF1 and all earlier versions, and the fix is 12.8.3 Hotfix 2. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-28987) scores it 9.1.

Zach Hanley of Horizon3.ai found it while studying CVE-2024-28986, a Java deserialization flaw in WHD disclosed on August 13 and fixed in Hotfix 1. Horizon3's [September 25 write-up](https://www.horizon3.ai/attack-research/cve-2024-28987-solarwinds-web-help-desk-hardcoded-credential-vulnerability-deep-dive/) published the account name and password baked into the code. It showed they unlock the `/OrionTickets` API, which lacks the localhost-only restriction many other WHD controllers have. With them, an attacker can "remotely read and modify all help desk ticket details," which often hold "passwords from reset requests and shared service account credentials." Horizon3 notes this does not compromise the WHD server itself, but the stolen secrets make lateral movement easy.

CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28987) on October 15, 2024, three weeks after the public proof of concept. Per [The Hacker News](https://thehackernews.com/2024/10/cisa-warns-of-active-exploitation-in.html), CISA cited "evidence of active exploitation" but has not said who was exploiting it or what prompted the listing.

## Who is affected

Self-hosted WHD 12.8.3 HF1 and earlier, per the advisory and the [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-28987). Note the trap: Hotfix 1, the fix for CVE-2024-28986, is itself vulnerable to this bug. The version floor has since moved well past Hotfix 2. [WHD 2026.1](https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm) (January 28, 2026) fixed six more SolarWinds CVEs, including another hardcoded credential flaw (CVE-2025-40537) and unauthenticated deserialization RCE (CVE-2025-40551), which CISA added to KEV in February 2026. The current release is [2026.2.1](https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-2-1_release_notes.htm) (July 30, 2026).

## Do you really need to act?

If you run WHD on 2026.1 or later, this CVE is closed. If you run anything older, yes: the credentials are public, the attack is a few HTTP requests, and the later bugs are worse. Exposure matters most. A help desk reachable from the internet is the realistic target. One reachable only from the internal network still leaks tickets to anyone already inside.

## What to do now

1. List every WHD server and its version from the admin console.
2. Upgrade to 2026.1, verify it works, then go to 2026.2.1, as SolarWinds' release notes require. Linux installs cannot upgrade in place to 2026.2.1 and need a migration.
3. Check reachability from outside, for example `curl -skI https://helpdesk.example.com/helpdesk/` from an external host, and move the interface behind a VPN.
4. Search logs on Windows with `Select-String -Path "C:\Program Files\WebHelpDesk\Logs\whd_access_log.*.log" -Pattern "OrionTickets"`.
5. Rotate any credential that ever appeared in a ticket.

## How to tell if you were hit

Horizon3 points to `C:\Program Files\WebHelpDesk\Logs\whd_access_log.<YYYY-MM-DD>.log`. Look for an unrecognized IP address calling the OrionTickets endpoints, especially bulk listing followed by single-ticket reads. Then check ticket history for edits no technician made, since the bug allows writes. Search ticket text for passwords and keys, and review those accounts for logins from new places after the exposure window.

## Timeline

- Aug 13, 2024 — SolarWinds discloses CVE-2024-28986; Hotfix 1 follows.
- Aug 21, 2024 — SolarWinds releases 12.8.3 Hotfix 2 for CVE-2024-28987, and the CVE is published.
- Sep 25, 2024 — Horizon3.ai publishes technical details and the hardcoded credentials.
- Oct 15, 2024 — CISA adds CVE-2024-28987 to KEV; the federal deadline is November 5, 2024.
- Jan 28, 2026 — WHD 2026.1 fixes six further critical and high-severity bugs.
- Jul 30, 2026 — WHD 2026.2.1 becomes the current release.

## Sources

1. [SolarWinds — Web Help Desk Hardcoded Credential Vulnerability (CVE-2024-28987)](https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987)
2. [SolarWinds — Web Help Desk 2026.1 release notes](https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm)
3. [SolarWinds — Web Help Desk 2026.2.1 release notes](https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-2-1_release_notes.htm)
4. [CVE record — CVE-2024-28987](https://www.cve.org/CVERecord?id=CVE-2024-28987)
5. [NVD — CVE-2024-28987](https://nvd.nist.gov/vuln/detail/CVE-2024-28987)
6. [CISA — Known Exploited Vulnerabilities: CVE-2024-28987](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28987)
7. [Horizon3.ai — CVE-2024-28987: SolarWinds Web Help Desk hardcoded credential vulnerability deep-dive](https://www.horizon3.ai/attack-research/cve-2024-28987-solarwinds-web-help-desk-hardcoded-credential-vulnerability-deep-dive/)
8. [The Hacker News — CISA warns of active exploitation in SolarWinds Help Desk software vulnerability](https://thehackernews.com/2024/10/cisa-warns-of-active-exploitation-in.html)

---
Source page: https://erroneo.us/security/briefs/solarwinds-web-help-desk-cve-2024-28987-hardcoded-credentials/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt