CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
Published Aug 21, 2024 · Updated Jun 17, 2026
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.
References
- https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Web-Help-Desk-12-8-3-Hotfix-2
- https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987
- https://www.theregister.com/2024/08/22/hardcoded_credentials_bug_solarwinds_whd/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28987
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More SolarWinds vulnerabilities
All SolarWinds entriesCVE-2026-28318
SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
high7.5ExploitedJun 4, 2026CVE-2025-40536
SolarWinds Web Help Desk Security Control Bypass Vulnerability
critical9.8ExploitedJan 28, 2026CVE-2025-40551
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
critical9.8ExploitedJan 28, 2026CVE-2025-26399
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
critical9.8ExploitedSep 23, 2025CVE-2024-28986
SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
critical9.8ExploitedAug 13, 2024CVE-2024-28995
SolarWinds Serv-U Path Traversal Vulnerability
high7.5ExploitedJun 6, 2024