SolarWinds Web Help Desk Flaws: Technical Analysis, Triage, and Defense

Correction (October 8, 2026): An earlier version of this article said CVE-2024-28987 was only "monitored by threat intelligence." CISA added it to its Known Exploited Vulnerabilities catalog on October 15, 2024, as a SolarWinds Web Help Desk hardcoded credential vulnerability. The table below has been corrected.

Attackers are actively targeting critical vulnerabilities in SolarWinds Web Help Desk, converting IT service management infrastructure into unauthenticated initial access footholds and reconnaissance hubs. The dual flaws—tracked as CVE-2024-28986 and CVE-2024-28987—grant adversaries the ability to execute remote system commands and extract internal support ticket databases containing administrative credentials, architectural schematics, and cleartext access tokens.

Global internet scanning telemetry reveals over 820 publicly reachable Web Help Desk instances. Mass internet scanning for exposed instances is also driving exploitation of Oracle WebLogic's CVE-2026-21962 proxy bypass. More than 65 percent of exposed endpoints belong to State, Local, and Education (SLED) organizations, where public-facing ticketing systems frequently operate outside segmented network perimeters.

Decoupling RCE and API Exfiltration Mechanics

Initial reporting frequently mischaracterized these flaws as a sequential exploit chain. In production environments, they operate as distinct, standalone vulnerabilities residing in separate architectural layers of the application.

Technical Analysis: CVE-2024-28986 (Java Deserialization)

SolarWinds Web Help Desk relies on the legacy Java WebObjects framework. The application exposes an AJAX JSON bridge handler mapped through routes such as /helpdesk/WebObjects/Helpdesk.woa/ajax/.

When incoming requests hit AjaxProxy.handleRequest, the JSON payload passes into org.jabsorb.JSONBridge.call. Deserialization occurs during parameter unmarshalling within BeanSerializer. When resolving generic Object parameters, BeanSerializer dynamically instantiates the class defined in the attacker-controlled javaClass attribute using default constructors and invokes corresponding setter methods.

By supplying the C3P0 library class com.mchange.v2.c3p0.WrapperConnectionPoolDataSource alongside a hex-encoded serialized Java payload in userOverridesAsString, attackers trigger standard readObject execution. This instantiates secondary gadget chains that invoke Runtime.getRuntime().exec(), executing arbitrary system commands under the permissions of the underlying service account.

Technical Analysis: CVE-2024-28987 (Hardcoded Credentials)

Identified during security reviews of the initial hotfix, CVE-2024-28987 resides in whd-core.jar within Application.java. Endpoints under /OrionTickets/* handle SolarWinds Orion platform synchronization via OrionTicketController, which extends BasicAuthRouteController.

Static validation strings were embedded directly into controller authentication logic:

• Username: helpdeskIntegrationUser
• Password: dev-C4F8025E7
• Authorization Header: Basic aGVscGRlc2tJbnRlZ3JhdGlvblVzZXI6ZGV2LUM0RjgwMjVFNw==

Unauthenticated attackers supplying this Base64 header to /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets can paginate and dump every historical ticket, technician note, asset inventory record, and user attribute without executing host commands.

Forensic Artifacts and Host Log Triage

Incident responders must inspect web access logs and endpoint process trees across default installation paths:

• Windows: C:\Program Files\WebHelpDesk\Logs\whd_access_log.<YYYY-MM-DD>.log
• Linux: /usr/local/webhelpdesk/logs/whd_access_log.<YYYY-MM-DD>.log

Log Analysis and Critical Visibility Gaps

Adversaries querying the ticket export interface generate distinct HTTP access entries:

198.51.100.24 - - [18/Aug/2024:14:22:10 +0000] "GET /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets HTTP/1.1" 200 45892
198.51.100.24 - - [18/Aug/2024:14:22:35 +0000] "GET /helpdesk/WebObjects/Helpdesk.woa/ra/OrionTickets/1024 HTTP/1.1" 200 8124

Critical Logging Gap: Standard Web Help Desk access logs do not capture HTTP request headers. Because the Authorization header is omitted, malicious requests using hardcoded credentials share identical URI patterns with legitimate Orion platform synchronizations. Forensic teams must correlate source IP addresses against authorized management subnets.

Auditing Ticket Repositories for Exposed Secrets

Because CVE-2024-28987 enables silent data exfiltration, patching the host software does not remediate exposure of stored credentials. Stolen credentials like these have become ransomware's leading entry point, ahead of vulnerability exploitation, per our analysis of 661 incident-response cases. Security teams must audit backend databases (PostgreSQL, Microsoft SQL Server, MySQL, Oracle) across primary data tables:

• JOB_TICKET: Issue descriptions, subjects, and submitter profiles.
• TECH_NOTE: Internal technician troubleshooting notes and temporary credentials.
• ASSET and CLIENT: Network hostnames, IP allocations, and directory metadata.

-- Audit ticket records and technician notes for sensitive terms
SELECT
 jt.JOB_TICKET_ID,
 jt.SUBJECT,
 jt.REPORT_DATE,
 jt.CLIENT_ID,
 tn.NOTE_TEXT
FROM
 JOB_TICKET jt
LEFT JOIN
 TECH_NOTE tn ON jt.JOB_TICKET_ID = tn.JOB_TICKET_ID
WHERE
 jt.SUBJECT ILIKE ANY (ARRAY['%password%', '%vpn%', '%credential%', '%service account%', '%access key%', '%token%', '%login%', '%private key%', '%ssh-rsa%'])
 OR jt.QUESTION_TEXT ILIKE ANY (ARRAY['%password%', '%vpn%', '%credential%', '%service account%', '%access key%', '%token%', '%login%', '%private key%', '%ssh-rsa%'])
 OR tn.NOTE_TEXT ILIKE ANY (ARRAY['%password%', '%vpn%', '%credential%', '%service account%', '%access key%', '%token%', '%login%', '%private key%', '%ssh-rsa%'])
ORDER BY
 jt.REPORT_DATE DESC;

SIEM Detection Engineering and Threat Hunting

Deploy behavioral rules across SIEM, EDR, and endpoint inspection tools to detect active exploitation.

Sigma Rule: Java Runtime Spawning Command Interpreters

title: SolarWinds WHD Java Process Spawning Command Shell
id: b8d58e39-16a2-4a7b-a19f-0c4a408bfa12
status: stable
description: Detects command shells and discovery tools spawned directly by the Web Help Desk Java engine.
logsource:
 category: process_creation
 product: windows
detection:
 selection_parent:
 ParentImage|endswith:
 - '\WebHelpDesk\bin\jre\bin\java.exe'
 - '\WebHelpDesk\bin\jre\bin\javaw.exe'
 selection_child:
 Image|endswith:
 - '\cmd.exe'
 - '\powershell.exe'
 - '\pwsh.exe'
 - '\certutil.exe'
 - '\whoami.exe'
 - '\net.exe'
 condition: selection_parent and selection_child
level: critical
tags:
 - attack.execution
 - attack.t1059.001
 - attack.t1190

EDR Hunting and YARA Detection

Execute process ancestry hunting in Microsoft Defender for Endpoint using KQL:

DeviceProcessEvents
| where InitiatingProcessFileName =~ "java.exe"
 and InitiatingProcessFolderPath has @"WebHelpDesk"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "whoami.exe", "certutil.exe", "bitsadmin.exe", "net.exe", "sh.exe", "bash.exe")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc

Inspect web directories for deserialization artifacts and webshells using YARA:

rule WebHelpDesk_Exploit_Artifacts {
 meta:
 description = "Detects Java deserialization artifacts and hardcoded credentials associated with WHD"
 strings:
 $s1 = "WrapperConnectionPoolDataSource" ascii wide
 $s2 = "userOverridesAsString" ascii wide
 $s3 = "HexAsciiSerializedMap" ascii wide
 $s4 = "helpdeskIntegrationUser" ascii wide
 $s5 = "dev-C4F8025E7" ascii wide
 $magic_class = { CA FE BA BE }
 $magic_ser = { AC ED 00 05 }
 condition:
 ($magic_class at 0 or $magic_ser at 0 or filesize < 10MB) and
 (2 of ($s1, $s2, $s3) or all of ($s4, $s5))
}

Network Segmentation and Hardening Playbook

Remediation requires applying sequential vendor hotfixes, removing public internet routing, and enforcing administrative boundaries. Similar authentication-plane hardening applies to Check Point SmartConsole's CVE-2026-16232 auth bypass.

Remediation Workflow

1. Deploy Software Hotfixes: Upgrade instances to Web Help Desk 12.8.3 Hotfix 1 to mitigate Java deserialization, followed immediately by Hotfix 2 to eliminate hardcoded REST API credentials.
2. Eliminate Public Exposure: Remove direct WAN access to Web Help Desk servers. Enforce ingress through Zero Trust Network Access (ZTNA) or enterprise VPN solutions requiring multifactor authentication.
3. De-escalate Service Privileges: Run application services under local accounts or Group Managed Service Accounts (gMSA) with minimal local permissions. Service accounts must never hold Domain Admin privileges. The same alone-is-not-enough lesson applies to Akira ransomware's exploitation of a critical SonicWall flaw, where firmware updates alone failed to stop attackers.
4. Restrict Directory Integration: Restrict Active Directory synchronization to read-only queries over LDAPS (port 636).
5. Rotate Compromised Secrets: Force an immediate enterprise-wide rotation of all API keys, VPN credentials, local administrator passwords, and database connection strings discovered during the ticket database audit.

Related reading

• SonicWall SMA 1000 Zero-Day Attack Chain: Triage and Defense Guide
• Critical Apache OFBiz Flaws Expose Enterprise ERPs to Unauthenticated Remote Code Execution
• Interlock Ransomware Weaponizes Critical Cisco FMC Flaw: Why Standard Patching Fails