CYPHERLOCK, INC.

Critical Vulnerability in SolarWinds Web Help Desk Receives a 9.8 CVE Rating

SolarWinds has issued a critical alert urging its customers to address a severe security flaw in its Web Help Desk software. The vulnerability, disclosed in an advisory on Tuesday and updated last Friday, involves a Java deserialization issue that can enable remote code execution. This flaw, identified as CVE-2024-28986, has been assigned a CVSS score of 9.8, indicating its high severity.

The Cybersecurity and Infrastructure Security Agency (CISA) included this CVE in its Known Exploited Vulnerabilities list on Thursday, highlighting its critical nature.

SolarWinds Web Help Desk, which is commonly used by small and medium-sized enterprises and organizations with remote employees, is affected. Despite the vulnerability being reported as unauthenticated, SolarWinds found through extensive testing that reproduction of the issue required prior authentication.

To mitigate potential risks, SolarWinds advises all users to apply the provided hotfix. However, they caution that if Security Assertion Markup Language (SAML) for single sign-on (SSO) is in use, users should hold off on the patch until a specific update addressing this scenario is released.

The vulnerability affects Web Help Desk versions 12.8.3 and earlier.

More Articles & Posts

Scopes

2025 Active Exploitation AI Alert Analysis Attack Attackers Attacks Breach Breaches Campaigns China chrome CISA Cisco CISO CISOs credentials Critical Critical Flaw Critical Vulnerability CrowdStrike Cutting-Edge Cyber Attack Cyberattack cyberattacks Cybercriminals cybersecurity Cybersecurity Initiatives Cybersecurity Solutions Cyber Threats DDoS Attacks Discovered Enables Exploit Exploited Exploiting Exploits Exposes FBI Flaw Generative AI google Guide Hackers Hackers Exploit Healthcare Hijack Hit Insights Invest Ivanti Linux macOS malicious malware Massive data Breach MFA microsoft Microsoft 365 Microsoft Azure NIST Patch Phishing Phishing Attack PoC Privilege Escalation Ransomware Ransomware Attack ransomware attacks RCE RCE Vulnerability Released Remote Code Execution Researchers risk Scam security Security Flaw Strategies Strategy Systems Target Targeted Targeting Targets Threat Actors Threat Intelligence threats UK Unauthorized Code Execution Under Attack Users vulnerabilities Vulnerability WhatsApp windows Windows 11 Windows Systems Zero-Day