Loading story…
SolarWinds released security updates for Web Help Desk (WHD) to address two critical vulnerabilities affecting versions 12.4 through 12.8. One issue, CVE-2024-28986, is a Java deserialization flaw that can lead to remote code execution and carries a CVSS 9.8 rating; public reporting said the vulnerability was actively exploited. A second critical issue, tracked in SolarWinds advisories as CVE-2024-28987, involves built-in accounts with default passwords that could let attackers gain unauthorized remote access and modify data.
SolarWinds advised customers to upgrade to WHD 12.8.3 and apply Hotfix 1 and Hotfix 2, with backups taken before installing the fixes. The vendor published a trust-center advisory for CVE-2024-28987, while external incident reporting highlighted the urgency of patching because the flaws could allow both full compromise of vulnerable servers and abuse of default credentials in exposed deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
SolarWinds released Web Help Desk 12.8.3 Hotfix 1 to address critical vulnerabilities affecting WHD versions 12.4 through 12.8. The fixes were recommended as part of the vendor's remediation guidance.
CSIRT.SK reported that SolarWinds had released updates for two critical Web Help Desk vulnerabilities and stated that CVE-2024-28986 was being actively exploited. The notice urged immediate upgrading to WHD 12.8.3 followed by Hotfix 1 and Hotfix 2.
SolarWinds published a Trust Center security advisory for CVE-2024-28987, one of two critical Web Help Desk vulnerabilities. The issue involved built-in accounts with default passwords that could enable unauthorized remote access and data modification.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds released security updates for *Web Help Desk (WHD)* to address multiple critical vulnerabilities that could allow **unauthenticated remote attackers** to bypass authentication and achieve **remote code execution (RCE)**. The patched issues include two critical authentication bypass flaws, **CVE-2025-40552** and **CVE-2025-40554** (reported by watchTowr researcher Piotr Bazydlo), and two critical RCE flaws tied to **untrusted data deserialization**, **CVE-2025-40553** (Bazydlo) and **CVE-2025-40551** (reported by Horizon3.ai researcher Jimi Sebree), enabling remote command execution without prior access. SolarWinds also fixed a high-severity **hardcoded credentials** issue, **CVE-2025-40537**, which could enable unauthorized access to administrative functions under certain conditions. The vendor advised administrators to upgrade to **Web Help Desk 2026.1** and patch quickly, noting WHD has a history of being targeted and previously had vulnerabilities flagged as actively exploited by CISA, reinforcing the likelihood of rapid attacker interest following disclosure and patch availability.
Jun 29, 2026
SolarWinds released **Web Help Desk 12.8.7 Hotfix 1** to fix **`CVE-2025-26399`**, a critical unauthenticated remote code execution flaw affecting versions earlier than the hotfix. The vulnerability stems from unsafe deserialization in the **AjaxProxy** component and can allow a remote attacker to run commands and potentially take full control of an exposed system. SolarWinds published release notes for the hotfix and updated installation and upgrade guidance to support remediation. The flaw was reported as a bypass of earlier incomplete fixes tied to **`CVE-2024-28988`** and **`CVE-2024-28986`**, making it the third update in the patch sequence for the same attack surface. CSIRT.SK urged administrators to upgrade immediately to **12.8.7 Hotfix 1**, noting that **`CVE-2024-28986`** had already been added to CISA's Known Exploited Vulnerabilities catalog, underscoring the risk to organizations still running vulnerable Web Help Desk deployments.
Jul 24, 2026
SolarWinds warned that multiple vulnerabilities in **Web Help Desk** are being actively exploited, with reporting highlighting a critical flaw that can lead to **remote code execution** on exposed help-desk servers. Public references tie the activity to `CVE-2025-40554`, while additional SolarWinds advisories and third-party research point to related issues including `CVE-2025-40552`, `CVE-2025-40553`, and `CVE-2025-40536`, indicating a broader security problem affecting the product. Security researchers and defenders published proof-of-concept material and detection guidance shortly after disclosure, including a watchTowr repository focused on Web Help Desk exploitation and a GitHub Gist describing **uncommon process activity** associated with compromise. The combination of vendor advisories, media reporting, and public exploit research indicates that attackers moved quickly to weaponize the flaws, increasing risk for organizations that have not patched, isolated, or monitored SolarWinds Web Help Desk deployments.
Jul 12, 2026