SolarWinds Web Help Desk Pre-Auth RCE Vulnerability Disclosed
Severity: Medium (Score: 48.7)
Sources: Labs.Watchtowr, Reddit
Published: · Updated:
Keywords: help, desk, bundle, remote, access, solution, solarwinds
Severity indicators: rce, ot
Summary
CVE-2024-28988 is a pre-auth deserialization remote code execution vulnerability in SolarWinds Web Help Desk. It was reported through the Zero Day Initiative and disclosed in October 2024, but remained unpatched until September 2025, affecting users of the software. The vulnerability allows unauthorized access to systems using the affected software.
Source articles (2)
- Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre — Labs.Watchtowr · 2026-02-25
CVE-2024-28988 - a pre-auth deserialization RCE reported through the Zero Day Initiative. It was disclosed in October 2024, but not patched until ... - Buy A Help Desk, Bundle A Remote Access Solution? (SolarWinds Web Help Desk Pre-Auth RCE Chain(s)) — Reddit · 2026-02-25
submitted by /u/dx7r__ [link] [ ]
Timeline
- 2024-10-01 — CVE-2024-28988 disclosed
- 2025-09-01 — CVE-2024-28988 published
- 2026-02-25 — Articles published discussing the vulnerability
CVEs
Related entities
- Zero-day Exploit (Attack Type)
- SolarWinds (Company)
- Zero Day Initiative (Company)