Security Digest · Aug 13, 2024 · Vulnerability · Other
SolarWinds Web Help Desk CVE-2024-28986: Java RCE
Java deserialization RCE in Web Help Desk 12.8.3 and earlier, exploited in 2024. Its hotfix was bypassed twice; only WHD 2026.1 or later is safe. Check.
Our verdict
Check exposure
The August 2024 hotfix is long superseded; any Web Help Desk below 2026.1 is open to later, exploited bypasses of this same bug, so confirm the version and hunt for past compromise.
Who must act: Anyone still running Web Help Desk 12.x, including 12.8.3 with any hotfix, and especially where the WHD web interface is reachable from the internet.
Who can relax: Organizations that do not run Web Help Desk, or that moved to WHD 2026.1 or later in early 2026 and found no signs of compromise.
- Affected
- Web Help Desk 12.8.3 and all earlier versions (CVE-2024-28986)
Web Help Desk 12.8.8 HF1 and earlier remain vulnerable to the later bypasses - Fixed in
- Web Help Desk 12.8.3 Hotfix 1 (original fix, superseded)
Web Help Desk 2026.1 or later (current remedy) - CVSS
- 9.8 (v3.1, CNA)
- EPSS
- 84.6% (percentile 99.7)
- CISA KEV
- Yes, listed as known exploited
- Exploitation
- Exploited in the wild
- Severity
- Critical
What to do
- Find every Web Help Desk server and record its version and hotfix level.
- Upgrade anything below 2026.1 to 2026.1, then to the current 2026.x release, following SolarWinds' upgrade path.
- Take the WHD web interface off the internet; put it behind a VPN or an allow-list.
- If a WHD server ran 12.x with internet exposure, treat it as possibly compromised and reset service, admin and stored credentials.
- Plan around the 12.x end of life on November 30, 2026; no further 12.x fixes are coming.
How to check if you are affected or compromised
- Look for java.exe or javaw.exe under the WebHelpDesk folder spawning cmd.exe, PowerShell, msiexec or bitsadmin.
- Search WHD application logs for org.jabsorb.JSONRPCBridge exceptions and JSONRPC or AjaxProxy errors, and access logs for unusual /Helpdesk.woa/wo/ requests.
- Check WHD hosts for unexpected remote-access tools, new services or scheduled tasks created since August 2024.
What happened#
In mid-August 2024, SolarWinds disclosed CVE-2024-28986, a Java deserialization flaw in Web Help Desk (WHD) that lets an attacker run commands on the host. The CVE record went live on August 13. The CNA score is CVSS 3.1 9.8. The bug was reported as unauthenticated, but SolarWinds said it could not reproduce it without a login. It shipped WHD 12.8.3 Hotfix 1 anyway. Two days later, on August 15, CISA added the CVE to the KEV catalog. Neither CISA nor SolarWinds described the attacks, the victims or the actor, and as of Oct 23, 2026 none of that has been disclosed.
The fix had a rough life. SecurityWeek reported that Hotfix 1 broke SAML single sign-on and was pulled about a week later. Hotfix 2 followed on August 21 and also fixed CVE-2024-28987, a hardcoded credential found by Zach Hanley of Horizon3.ai. CISA listed that one as exploited on October 15, 2024.
Who is affected#
WHD 12.8.3 and all earlier versions are affected. Help Net Security put the range at 12.4 through 12.8. The real problem is that the patch did not hold. In October 2024, SolarWinds fixed CVE-2024-28988 in 12.8.3 HF3. That flaw, found by Trend Micro's ZDI, gave the same deserialization bug an unauthenticated path. CVE-2025-26399 (12.8.7 HF1, September 2025) bypassed that fix in turn. In January 2026, Horizon3.ai showed that the AjaxProxy component was still exploitable, and it recommends treating every version before 2026.1 as vulnerable. Our separate brief on CVE-2025-40551, CVE-2025-40536 and CVE-2025-26399 covers that 2026 wave, including its ransomware link.
Do you really need to act?#
For CVE-2024-28986 alone, this is a check. But a WHD server that stopped at a 12.8.3 hotfix is exposed to newer, unauthenticated, actively exploited bugs in the same code. Help desks hold password-reset tickets and service-account credentials, which makes them a useful foothold. SolarWinds' 2026.2.1 release notes list end of engineering for WHD 12.4 through 12.8.8 on July 4, 2026, and end of life on November 30, 2026. No further 12.x fixes are coming.
What to do now#
- Inventory WHD servers and record each one's version and hotfix level. Anything on 12.x, whatever the hotfix, is out of date.
- Upgrade anything below 2026.1. SolarWinds' upgrade path goes to 2026.1 first, then to the current 2026.x release.
- Remove internet exposure. Put WHD behind a VPN or an allow-list, as SolarWinds has recommended since 2024.
- If a 12.x server was internet-facing, reset WHD admin and service accounts, and rotate credentials stored in tickets or integrations.
How to tell if you were hit#
No 2024-specific indicators were published. The same component was attacked again in 2026, and those indicators apply. Horizon3 suggests searching the WHD application logs for org.jabsorb.JSONRPCBridge exceptions and JSONRPC or AjaxProxy errors. In the access logs, look for unusual /Helpdesk.woa/wo/ requests or parameters containing /ajax/. On the host, follow Microsoft's hunting approach and flag java.exe or javaw.exe under the WebHelpDesk folder spawning cmd.exe, PowerShell, msiexec or BITS jobs. Also check for remote-access tools or scheduled tasks nobody installed. Any of these means full compromise.
Timeline#
- — CVE-2024-28986 is published; SolarWinds ships WHD 12.8.3 Hotfix 1.
- — CISA adds the CVE to KEV, with a due date of September 5.
- — Hotfix 2 replaces the withdrawn Hotfix 1 and fixes CVE-2024-28987.
- — Hotfix 3 fixes the bypass CVE-2024-28988; CVE-2024-28987 is added to KEV.
- — SolarWinds discloses the second bypass, CVE-2025-26399 (fixed in 12.8.7 HF1).
- — WHD 2026.1 fixes a new AjaxProxy RCE chain.
- — End of life for WHD 12.4 through 12.8.8.
Vulnerability records
- CVE-2024-28986 · KEV 2024-08-15 · SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker…
Sources
Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.
Original and primary sources
- SolarWinds — CVE-2024-28986 Web Help Desk Java Deserialization RCE advisory solarwinds.com
- CVE record — CVE-2024-28986 cve.org
- NVD — CVE-2024-28986 nvd.nist.gov
- CISA — Known Exploited Vulnerabilities: CVE-2024-28986 cisa.gov
- SolarWinds — CVE-2024-28987 Web Help Desk hardcoded credential advisory solarwinds.com
- SolarWinds — CVE-2024-28988 Web Help Desk deserialization advisory solarwinds.com
- SolarWinds — CVE-2025-26399 Web Help Desk AjaxProxy deserialization advisory solarwinds.com
- SolarWinds — WHD 2026.2.1 release notes (12.x end-of-life dates) documentation.solarwinds.com
- Horizon3.ai — CVE-2025-40551 SolarWinds Web Help Desk horizon3.ai
- Microsoft Security — Active exploitation of SolarWinds Web Help Desk microsoft.com