# CVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerability

Source: https://junglewise.ai/threats/cve-2024-28987-solarwinds-web-help-desk-hardcoded-credential-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-10-15. Updated: 2026-05-09  
License: CC BY 4.0 with a link back

CVE-2024-28987 · Severity: critical · CVSS 9.1 · Exploited in the wild · Published 2024-10-15

SolarWinds Web Help Desk (WHD) contains a hardcoded credential vulnerability. A remote, unauthenticated attacker can exploit this to access internal functionality and modify sensitive data.

Technologies: [SolarWinds Web Help Desk](https://junglewise.ai/threats/technologies/web-help-desk). Vendors: [SolarWinds](https://junglewise.ai/threats/vendors/solarwinds).

## Quick answers

**Is CVE-2024-28987 exploited in the wild?** Yes. CVE-2024-28987 is known to be exploited in the wild, first recorded on 15 October 2024. Treat it as urgent.

**How severe is CVE-2024-28987?** Critical severity, with a CVSS score of 9.1, published 15 October 2024.

**Which products and versions are affected?** SolarWinds Web Help Desk (WHD) Up to (excluding) 12.8.3 Hotfix 2.

**Is there a fix for CVE-2024-28987?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-28987 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2024-28987?** Check whether you run SolarWinds Web Help Desk. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- SolarWinds Web Help Desk (WHD) Up to (excluding) 12.8.3 Hotfix 2

## Timeline

- 2024-08-21: disclosed: Initial CVE publication and vendor advisory
- 2024-10-15: kev added: Added to CISA Known Exploited Vulnerabilities (KEV) catalog
- 2024-10-15: exploited: Reported as exploited in the wild

## Related threats

- [SolarWinds Web Help Desk SAML authentication bypass](https://junglewise.ai/threats/cve-2026-28323-solarwinds-web-help-desk-saml-authentication-bypass)
- [SolarWinds Web Help Desk denial of service via memory exhaustion](https://junglewise.ai/threats/cve-2026-28299-solarwinds-web-help-desk-denial-of-service-via-memory-exhaustion)
- [SolarWinds Web Help Desk deserialization RCE in AjaxProxy](https://junglewise.ai/threats/cve-2025-26399-solarwinds-web-help-desk-deserialization-rce-in-ajaxproxy)
- [SolarWinds Web Help Desk security control bypass](https://junglewise.ai/threats/cve-2025-40536-solarwinds-web-help-desk-security-control-bypass)
- [SolarWinds Web Help Desk untrusted data deserialization](https://junglewise.ai/threats/cve-2025-40551-solarwinds-web-help-desk-untrusted-data-deserialization)