CVE-2024-28987

Description

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.

Scoring

• CVSS: 9.1 (CRITICAL, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2024-10-15
• Remediation due date: 2024-11-05
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-798

References

• https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2
• https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987
• https://www.theregister.com/2024/08/22/hardcoded_credentials_bug_solarwinds_whd/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28987

More from SolarWinds

• CVE-2026-28318 — Serv-U
• CVE-2025-26399 — Web Help Desk
• CVE-2025-40536 — Web Help Desk
• CVE-2025-40551 — Web Help Desk
• CVE-2024-28986 — Web Help Desk