CVE-2024-28988 SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability

Critical 9.8 Published 1 Sep 2025 Updated 26 Feb 2026

Unauthenticated attackers can execute arbitrary code on SolarWinds Web Help Desk hosts via Java deserialization flaws.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-28988?

CVE-2024-28988 is a critical unsafe deserialization vulnerability in SolarWinds Web Help Desk, published on 1 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. This vulnerability was found by the ZDI team after researching a previous vulnerability and providing this report. The ZDI team was able to discover an unauthenticated attack during their research.

We recommend all Web Help Desk customers apply the patch, which is now available.

We thank Trend Micro Zero Day Initiative (ZDI) for its ongoing partnership in coordinating with SolarWinds on responsible disclosure of this and other potential vulnerabilities.

Weakness: CWE-502

Which versions are affected by CVE-2024-28988?

It affects 1 product.

Products include Solarwinds Web Help Desk.

How do I fix CVE-2024-28988?

No fix has been published for CVE-2024-28988 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2024-28988 being exploited?

There is no known exploitation of CVE-2024-28988 in the wild and no public exploit code.

Sources

Also known as GHSA-3mr8-x6wp-2wc6.