PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-28987 SolarWinds CVE debrief

CVE-2024-28987 is a SolarWinds Web Help Desk hardcoded credential vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on 2024-10-15. That KEV designation means CISA considers it actively exploited in the wild. CISA’s guidance for KEV entries is to apply vendor mitigations or discontinue use of the product if mitigations are unavailable.

Vendor
SolarWinds
Product
Web Help Desk
CVSS
CRITICAL 9.1
CISA KEV
Listed
Original CVE published
2024-10-15
Original CVE updated
2024-10-15
Advisory published
2024-10-15
Advisory updated
2024-10-15

Who should care

Organizations that use SolarWinds Web Help Desk, especially security operations teams, system administrators, vulnerability management teams, and asset owners responsible for internet-facing or internally deployed help desk systems.

Technical summary

The available source corpus identifies CVE-2024-28987 as a hardcoded credential issue in SolarWinds Web Help Desk. CISA recorded it in KEV on 2024-10-15 with a remediation due date of 2024-11-05 and directs affected organizations to follow vendor mitigation guidance or stop using the product if no mitigations are available.

Defensive priority

Critical

Recommended defensive actions

  • Check whether SolarWinds Web Help Desk is deployed anywhere in your environment, including test and auxiliary systems.
  • Review the SolarWinds security advisory for CVE-2024-28987 and apply any vendor-provided mitigations immediately.
  • If mitigations are not available or cannot be applied quickly, discontinue use of the product per CISA guidance.
  • Validate whether any exposed credentials or related access paths need to be rotated or removed as part of your response plan.
  • Track remediation against the CISA KEV due date of 2024-11-05 and verify completion with asset owners.

Evidence notes

This debrief is grounded in the supplied CISA KEV entry and the official references provided in the corpus: the SolarWinds advisory link and the NVD record. The corpus identifies the vulnerability name, vendor, product, KEV status, dateAdded of 2024-10-15, and dueDate of 2024-11-05. No CVSS score was supplied.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-28987 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-28987

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-28987 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-28987

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.