Loading story…
SolarWinds released Web Help Desk 2026.2.1 to fix two vulnerabilities affecting the help desk platform: CVE-2026-28323, a critical authentication-bypass flaw, and CVE-2026-28299, a high-severity denial-of-service issue. The authentication-bypass bug affects deployments with SAML 2.0 enabled and could allow a remote unauthenticated attacker to craft or relay a malicious SAMLResponse and establish a session without valid credentials. The denial-of-service flaw can be triggered through unauthenticated interaction with a Web Help Desk endpoint, potentially causing resource exhaustion and service crashes.
Security guidance accompanying the release said no active exploitation had been observed, but warned that Web Help Desk is frequently internet-facing and that the no-credentials requirement makes the authentication bypass a likely target. Organizations were urged to patch immediately, disable SAML 2.0 if patching is delayed, enforce MFA through an identity provider or VPN/ZTNA, protect SAML endpoints with WAF or reverse-proxy controls, and reduce public internet exposure. SolarWinds also announced that Web Help Desk 12.8.8 and earlier will lose engineering support and reach final end of life later in 2026, increasing pressure on customers running legacy versions to upgrade.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Arctic Wolf Labs published a security bulletin detailing the two SolarWinds Web Help Desk vulnerabilities, noting no active exploitation had been observed at the time. The bulletin warned that WHD is often internet-facing and recommended immediate patching and compensating controls if patching is delayed.
SolarWinds released fixes for CVE-2026-28323, a critical authentication-bypass flaw, and CVE-2026-28299, a high-severity denial-of-service flaw in SolarWinds Web Help Desk. Both issues were addressed in Web Help Desk version 2026.2.1.
SolarWinds published an end-of-life announcement for numerous legacy SolarWinds Web Help Desk versions and told customers running affected releases to transition to the latest WHD version. The notice covers versions including WHD 12.8.8 and earlier.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds has patched a critical authentication bypass flaw in **Web Help Desk** that could allow unauthenticated attackers to access vulnerable instances when **SAML 2.0** single sign-on is enabled. Tracked as `CVE-2026-28323`, the issue affects **Web Help Desk 2026.1 and earlier** and is classified under `CWE-287`. SolarWinds rated the bug **CVSS 9.8**, with impact spanning confidentiality, integrity, and availability, raising the risk of exposure of help desk tickets, user data, internal communications, and IT asset records. The fix was released in **Web Help Desk 2026.2.1**, and SolarWinds said it has not disclosed exploit details or observed active exploitation. The same release also addresses `CVE-2026-28299`, a high-severity denial-of-service vulnerability, along with multiple **pgAdmin** issues. Organizations using SAML-based SSO on Web Help Desk have been urged to upgrade immediately, verify authentication behavior after patching, and review logs for signs of unauthorized access.
Jul 31, 2026
SolarWinds released a security update for **Web Help Desk 2026.1 and all previous versions** to remediate **`CVE-2026-28299`**, a network-exploitable denial-of-service vulnerability. According to the vendor notice cited by EG-FinCIRT, the flaw has **low attack complexity** and can be triggered **without privileges or user interaction**, increasing the risk of opportunistic exploitation against exposed systems. Successful exploitation could exhaust memory, crash the Web Help Desk server, and disrupt service availability. Organizations using SolarWinds Web Help Desk were urged to validate and deploy the update as soon as testing is complete to reduce the risk of outages caused by unauthenticated attacks.
Jul 8, 2026
SolarWinds released **Web Help Desk 12.8.7 Hotfix 1** to fix **`CVE-2025-26399`**, a critical unauthenticated remote code execution flaw affecting versions earlier than the hotfix. The vulnerability stems from unsafe deserialization in the **AjaxProxy** component and can allow a remote attacker to run commands and potentially take full control of an exposed system. SolarWinds published release notes for the hotfix and updated installation and upgrade guidance to support remediation. The flaw was reported as a bypass of earlier incomplete fixes tied to **`CVE-2024-28988`** and **`CVE-2024-28986`**, making it the third update in the patch sequence for the same attack surface. CSIRT.SK urged administrators to upgrade immediately to **12.8.7 Hotfix 1**, noting that **`CVE-2024-28986`** had already been added to CISA's Known Exploited Vulnerabilities catalog, underscoring the risk to organizations still running vulnerable Web Help Desk deployments.
Jul 24, 2026