The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-28987 (CVSS 9.1) to its Known Exploited Vulnerabilities catalog after confirming active in-the-wild exploitation targeting SolarWinds Web Help Desk (WHD). Discovered by Horizon3.ai researchers, the vulnerability stems from static credentials embedded directly within the application’s BasicAuthRouteController Java class. While SolarWinds previously implemented dynamic startup credential randomization to resolve CVE-2021-35232, this integration endpoint bypassed global property handlers, leaving the hardcoded username helpdeskIntegrationUser and password dev-C4F8025E7 statically exposed across versions 12.8.3 Hotfix 1 and earlier.

Remote, unauthenticated adversaries leverage these hardcoded credentials via HTTP Basic Authentication to access internal REST endpoints, allowing full read and write access to all ticket databases. Help desk tickets routinely contain Active Directory reset passwords, VPN configurations, and service account tokens, converting the flaw into an initial-access and lateral-movement pivot into internal enterprise networks. SolarWinds released remediation in Web Help Desk 12.8.3 Hotfix 2, and CISA has mandated that federal agencies secure exposed instances or restrict access behind boundary firewalls.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Hardcoded credentials embedded in web controllers bypass identity federation and multi-factor authentication, giving adversaries authenticated access to centralized ticket repositories that store cleartext administrative credentials and infrastructure topology.
• Bullet 2 — Strategic & Defender Imperative: Administrators must urgently deploy Web Help Desk 12.8.3 Hotfix 2, disconnect management consoles from the public internet, and audit help desk ticket histories to identify and rotate exposed Active Directory and service account passwords.