What is the CVSS score of CVE-2026-28299?

CVE-2026-28299 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of SolarWinds Web Help Desk are affected by CVE-2026-28299?

SolarWinds Web Help Desk versions 2026.1 and prior contain a denial-of-service vulnerability (CVE-2026-28299) that allows remote unauthenticated attackers to crash the service through uncontrolled…

How to fix or mitigate CVE-2026-28299?

Within 24 hours, implement rate limiting and IP-based access controls on your Web Help Desk deployment to restrict connection attempts from untrusted networks; enable verbose logging and memory monitoring to detect exploitation attempts. Within 7 days, establish a formal inventory of all SolarWinds Web Help Desk instances and verify they are running version 2026.1 or earlier (all versions affected), and document your current network segmentation and access controls. Within 30 days, establish a monitoring routine for vendor security updates, prepare a patching plan for immediate deployment once SolarWinds releases a fix, and evaluate network-layer protections (WAF/load balancer rate-limiting rules) to further restrict access to this service.

SolarWinds Web Help Desk CVE-2026-28299

EUVD-2026-34017 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-06-02 SolarWinds

GHSA-f247-223f-rhfm

Denial Of Service Web Help Desk Solarwinds

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, low-complexity, unauthenticated trigger (AV:N/AC:L/PR:N/UI:N) causing memory-exhaustion crash - availability only (A:H, C:N/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 22, 2026 - 19:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Jul 22, 2026 - 19:22 NVD

8.2 (HIGH) 7.5 (HIGH)

Analysis Generated

Jun 02, 2026 - 20:23 vuln.today

CVE Published

Jun 02, 2026 - 19:31 nvd

HIGH 8.2

DescriptionNVD

SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due to insufficient memory.

AnalysisAI

Denial-of-service in SolarWinds Web Help Desk (2026.1 and all prior versions) lets remote unauthenticated attackers exhaust server memory and crash the service. The flaw stems from uncontrolled resource allocation (CWE-770), and while there is no public exploit identified at time of analysis, CISA's SSVC framework flags the attack as automatable, meaning it could be scripted at scale. EPSS is very low (0.06%, 19th percentile), consistent with the absence of active exploitation.

Technical ContextAI

SolarWinds Web Help Desk is a Java-based IT service-management and ticketing appliance commonly fronted by an embedded web/application server. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the server accepts input that drives memory allocation without enforcing an upper bound, so a crafted or high-volume request forces the JVM to consume all available heap and terminate. Because the CVSS vector is AV:N/AC:L (network, low complexity) with no confidentiality or integrity impact and A:H, the weakness is a pure availability/resource-exhaustion issue reachable over the network against the affected CPE cpe:2.3:a:solarwinds:web_help_desk.

RemediationAI

Vendor-released patch: upgrade SolarWinds Web Help Desk to version 2026.2, which the release notes identify as the fixed build; consult the vendor advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28299 and the 2026.2 release notes at https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-2_release_notes.htm before deploying. Until the upgrade is applied, reduce network exposure by restricting access to the Web Help Desk web interface to trusted management networks or VPN rather than the public internet, and place a reverse proxy or WAF in front to enforce request-rate limiting and cap request/body sizes so a single client cannot drive unbounded memory allocation; the trade-off is that rate limits and access restrictions can inconvenience legitimate remote agents and self-service end users, so tune thresholds to normal ticketing volume. Monitor JVM heap usage and configure automatic service restart/health checks to shorten downtime if a crash occurs.