Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing. However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2024-09-05. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
WHD has a history here: CVE-2024-28986 → RCE CVE-2024-28988 → bypass CVE-2025-26399 → bypass Now… CVE-2025-40551 → bypass again
Post summary
The text lists several CVEs with brief vulnerability type descriptors but provides no exploitation or mitigation details.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | solarwinds | web_help_desk | - | - | - |
| App | solarwinds | web_help_desk | 12.8.3 | - | - |