SolarWinds Web Help Desk Java Deserialization
- Product
- SolarWinds Web Help Desk
- CVE
- CVE-2024-28986
- Disclosed
- 2024-08-13
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- 12.8.3 and all previous versions
- Fixed
- 12.8.3 Hotfix 1 (later 12.8.3 HF2 / 12.8.4)
Summary
A Java deserialization flaw in SolarWinds Web Help Desk was added to CISA KEV two days after the hotfix shipped. SolarWinds first described it as requiring authentication but later confirmed it was exploitable without credentials.
Root cause
WHD's WebObjects-based web tier deserialized attacker-controlled data from HTTP requests (the AjaxProxy endpoint) without type filtering, allowing gadget chains to run OS commands. A companion hardcoded-credential bug (CVE-2024-28987) shipped in the same timeframe.
Impact
Unauthenticated RCE on the help desk server, which often stores credentials for integrated systems.
Detection
Inspect requests to /helpdesk/WebObjects/Helpdesk.woa/ajax/ (AjaxProxy) with serialized Java content; check the WHD version. nuclei template CVE-2024-28986.
Mitigation
Install 12.8.3 Hotfix 1 or later; current releases also fix the follow-on patch bypasses CVE-2024-28988 and CVE-2025-26399.