EUVD-2026-34017
GHSA-f247-223f-rhfm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Web Help Desk web service
-
DeliverySend crafted/repeated request
-
ExploitTrigger unbounded memory allocation (CWE-770)
-
ExecutionExhaust JVM heap
-
ImpactCrash server, deny service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of SolarWinds Web Help Desk (CVSS AV:N/AC:L/PR:N/UI:N), reachable by any client that can send requests to the Web Help Desk web/application service. The limiting factors are that impact is confined to availability (a server crash from memory exhaustion) with no confidentiality or integrity effect, that only versions 2026.1 and earlier are affected (2026.2 is fixed), and that exposure depends on whether the Web Help Desk interface is reachable from the attacker's network position - internet-facing deployments are directly exploitable while instances restricted to internal management networks are not. |
| Impact | The signals are internally consistent and point to a real but non-urgent availability risk. CVSS 7.5 (HIGH) reflects easy network-based triggering (AV:N/AC:L/PR:N/UI:N) with impact limited to availability (A:H, C:N/I:N). Against that, EPSS is only 0.06% (19th percentile) and SSVC lists Exploitation: none, so there is no evidence of exploitation in the wild and no public POC. SSVC does mark the attack Automatable: yes with Technical Impact: partial, so if a technique emerges it could be repeated cheaply - but a partial technical impact plus a crash-only outcome keeps this below the priority of an RCE or data-exposure bug. Net: patch on a normal maintenance cadence rather than emergency; the high CVSS is driven purely by availability and is not corroborated by any exploitation signal. |
| Exploit ScenarioDerived | An attacker with only network reachability to the Web Help Desk web service sends a crafted or repeated request that triggers unbounded memory allocation, driving the JVM heap to exhaustion until the process crashes and ticketing/help-desk operations go offline. No authentication or user interaction is required (PR:N/UI:N) and complexity is low (AC:L); SSVC rates the attack automatable, so it could be scripted to knock the server over repeatedly, though no public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 22, 2026
Denial-of-service in SolarWinds Web Help Desk (2026.1 and all prior versions) lets remote unauthenticated attackers exhaust server memory and crash the service. The flaw stems from uncontrolled resource allocation (CWE-770), and while there is no public exploit identified at time of analysis, CISA's SSVC framework flags the attack as automatable, meaning it could be scripted at scale. EPSS is very low (0.06%, 19th percentile), consistent with the absence of active exploitation.
Earlier versions of this analysis (1)
Denial-of-service in SolarWinds Web Help Desk allows remote unauthenticated attackers to crash the server by exhausting available memory. The flaw is network-reachable with low attack complexity and requires no privileges or user interaction (CVSS 8.2), and no public exploit identified at time of analysis. The issue was reported by SolarWinds and addressed in the Web Help Desk 2026.2 release.
RemediationAI
Vendor-released patch: upgrade SolarWinds Web Help Desk to version 2026.2, which the release notes identify as the fixed build; consult the vendor advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28299 and the 2026.2 release notes at https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-2_release_notes.htm before deploying. Until the upgrade is applied, reduce network exposure by restricting access to the Web Help Desk web interface to trusted management networks or VPN rather than the public internet, and place a reverse proxy or WAF in front to enforce request-rate limiting and cap request/body sizes so a single client cannot drive unbounded memory allocation; the trade-off is that rate limits and access restrictions can inconvenience legitimate remote agents and self-service end users, so tune thresholds to normal ticketing volume. Monitor JVM heap usage and configure automatic service restart/health checks to shorten downtime if a crash occurs.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SolarWinds Web Help Desk is a Java-based IT service-management and ticketing appliance commonly fronted by an embedded web/application server. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the server accepts input that drives memory allocation without enforcing an upper bound, so a crafted or high-volume request forces the JVM to consume all available heap and terminate. Because the CVSS vector is AV:N/AC:L (network, low complexity) with no confidentiality or integrity impact and A:H, the weakness is a pure availability/resource-exhaustion issue reachable over the network against the affected CPE cpe:2.3:a:solarwinds:web_help_desk.
Know when Web Help Desk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, low-complexity, unauthenticated trigger (AV:N/AC:L/PR:N/UI:N) causing memory-exhaustion crash - availability only (A:H, C:N/I:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due to insufficient memory.
Executive ViewAI
SolarWinds Web Help Desk versions 2026.1 and prior contain a denial-of-service vulnerability (CVE-2026-28299) that allows remote unauthenticated attackers to crash the service through uncontrolled memory exhaustion. While no public exploit identified at time of analysis, the attack is automatable and poses an availability risk to help desk operations; organizations must implement compensating controls immediately as no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) implement rate limiting and connection throttling to prevent resource exhaustion; (2) restrict network access to Web Help Desk via firewall rules or IP allowlisting; (3) deploy web application firewall rules to detect anomalous request patterns; (4) configure automated service monitoring with restart capabilities; (5) enable enhanced logging and alerting for memory utilization spikes; (6) consider deploying Web Help Desk behind a reverse proxy with request queuing to absorb burst traffic.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Web Help Desk
View allSolarWinds Web Help Desk contains an unauthenticated Java deserialization vulnerability (CVE-2025-40551, CVSS 9.8) that
SolarWinds Web Help Desk contains a security control bypass vulnerability (CVE-2025-40536) that allows unauthenticated a
SolarWinds Web Help Desk contains an unauthenticated deserialization RCE via AjaxProxy, a patch bypass of both CVE-2024-
SolarWinds Web Help Desk has an authentication bypass vulnerability (EPSS 9.9%) that allows unauthenticated attackers to
SolarWinds Web Help Desk has a second authentication bypass (EPSS 7.8%) providing yet another path to unauthenticated ad
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that,
The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthe
SolarWinds Web Help Desk has a second deserialization vulnerability (EPSS 11.9%) providing another unauthenticated RCE p
SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that,
Authentication bypass in SolarWinds Web Help Desk (WHD) allows remote unauthenticated attackers to circumvent SAML 2.0 s
SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situat
The HTTP PUT and DELETE methods were enabled in the Web Help Desk web server (12.7.7 and earlier), allowing users to exe
Exploit-DB