CVE-2026-28299 SolarWinds Web Help Desk Denial-of-Service Vulnerability
Attackers can crash the SolarWinds Web Help Desk server by triggering insufficient memory conditions, requiring administrators to apply vendor patches.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-28299?
CVE-2026-28299 is a high-severity denial of service vulnerability in SolarWinds Web Help Desk, published on 2 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due to insufficient memory.
Weakness: CWE-770
Which versions are affected by CVE-2026-28299?
It affects 1 product.
Products include Solarwinds Web Help Desk.
How do I fix CVE-2026-28299?
No fix has been published for CVE-2026-28299 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-28299 being exploited?
There is no known exploitation of CVE-2026-28299 in the wild and no public exploit code.
Other vulnerabilities in SolarWinds Web Help Desk
- CVE-2025-40551 SolarWinds Web Help Desk Deserialization of Untrusted Data
- CVE-2025-26399 SolarWinds Web Help Desk Deserialization of Untrusted Data
- CVE-2024-28986 SolarWinds Web Help Desk Deserialization of Untrusted Data
- CVE-2024-28987 SolarWinds Web Help Desk Hardcoded Credential
- CVE-2025-40536 SolarWinds Web Help Desk Security Control Bypass
Sources
Also known as GHSA-f247-223f-rhfm.