CVE-2024-28987: SolarWinds Web Help Desk hardcoded credentials, actively exploited
The short version: SolarWinds Web Help Desk (WHD) contained a hardcoded credential (CVE-2024-28987) — a static username and password baked into the software — that a remote, unauthenticated attacker can use to reach internal functionality and read or modify help-desk data. It's in CISA's KEV catalog. There's no clever exploit here; if you know the credential, you're in. Patch it. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice (see below) |
| CVSS v3.1 (NVD) | 9.1 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| EPSS | 93.30% · 99.8th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2024-11-05 |
| Known exploited? | Yes — exploited in the wild |
| Vulnerability type | CWE-798 use of hardcoded credentials → unauthenticated access to read and modify data |
| Requires authenticated session? | No — the built-in credential is the access |
| Affected | SolarWinds Web Help Desk 12.8.3 Hotfix 1 and earlier |
| Fixed in | Web Help Desk 12.8.3 Hotfix 2 or later |
What you need to know
CVE-2024-28987 is a hardcoded credential. A specific username/password pair was embedded in the WHD software, and anyone who knows it can authenticate to internal endpoints without being a legitimate user — then read help-desk tickets and modify data.
Why this outruns "just a password problem":
- The credential is public knowledge now. Once a hardcoded secret is disclosed, there's nothing to guess and nothing to brute-force — the barrier to entry is essentially zero.
- Help-desk systems are full of sensitive material. Tickets routinely contain internal hostnames, account details, reset requests, and sometimes credentials themselves.
- It's confirmed exploited. CISA added it to KEV, so this is operational, not theoretical.
How serious we see it
Critical — in practice, close to the 9.1 on paper.
NVD scores it Critical, and the mechanics support that: unauthenticated, network-reachable access to read and modify data. We land on High because the impact is data access rather than full code execution on the host — but a KEV-listed, trivially usable built-in credential on an internet-facing help-desk portal is a top-of-queue fix, and the gap between our take and the CVSS band is small. The steadying part: it's a specific product and version, the fix exists, and exposure is quick to confirm.
Recommendations
Straight from SolarWinds' advisory and CISA:
- Patch now. Upgrade to Web Help Desk 12.8.3 Hotfix 2 or later, which removes the hardcoded credential.
- Confirm your exposure first. Verify whether you run an internet-facing WHD instance and which build.
- Restrict reachability. Keep WHD off the public internet where you can; limit access to trusted networks.
- Hunt for prior use. Review access logs for use of the affected endpoints and any unexpected data changes.
- Rotate exposed secrets. If tickets or records containing credentials were reachable, treat them as compromised.
How BreachRisk sees it
BreachRisk discovers internet-facing Web Help Desk portals from little more than your domain, fingerprints the product and version, and flags exposure tied to CVE-2024-28987 — raised to the top because it's in KEV. Where authorized, it goes beyond version matching: it performs a safe, bounded check against the affected endpoint to confirm the hardcoded-credential path actually responds, as a benign verification rather than a data pull.
That's the honest difference between "this build looks affected" and "we confirmed the exposed path holds" — and because it's continuous and outside-in, the vulnerable portal is already on your radar when a flaw like this breaks.