Dive Brief: 

• SolarWinds is urging customers to patch a critical vulnerability in its Web Help Desk application, in a Tuesday advisory, which was last updated Friday.
• The company disclosed a java deserialization remote code execution vulnerability that, if successfully exploited, could allow an attacker to run commands on a host machine. The vulnerability, listed as CVE-2024-28986, has a CVSS score of 9.8.
• The Cybersecurity and Infrastructure Security Agency on Thursday added the CVE to its Known Exploited Vulnerabilities catalog. 

Dive Insight:

SolarWinds Web Help Desk is a widely used application for IT management and help desk ticketing. The application is used by a variety of small to mid-sized businesses and companies with remote workers. 

SolarWinds cautioned that while the issue was reported as an unauthenticated vulnerability, it was unable to reproduce the issue without prior authentication after conducting a thorough amount of testing.

The company said all users of the application should apply the hotfix out of an abundance of caution. 

The company warned the patch should not be applied if security assertion markup language for single-sign on is utilized, as a new patch will be issued to address that scenario. 

The issue impacts SolarWinds Web Help Desk versions 12.8.3 and earlier.