What is the CVSS score of EUVD-2026-34017?

EUVD-2026-34017 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.1%.

Which versions of SolarWinds Web Help Desk are affected by EUVD-2026-34017?

SolarWinds Web Help Desk (all versions prior to 2026.2) contains a remote denial-of-service vulnerability allowing unauthenticated attackers to crash servers by exhausting memory, potentially…

How to fix or mitigate EUVD-2026-34017?

Within 24 hours: Identify all SolarWinds Web Help Desk instances and document current versions; assess exposure (internal vs. internet-facing). Within 7 days: Apply vendor patch to Web Help Desk 2026.2 across all production systems after testing in non-production environment. Within 30 days: Verify patch completion across all instances and implement monitoring for unusual memory consumption to detect exploitation attempts.

SolarWinds Web Help Desk EUVD-2026-34017

| CVE-2026-28299 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-06-02 SolarWinds

GHSA-f247-223f-rhfm

Denial Of Service Web Help Desk

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 20:23 vuln.today

CVE Published

Jun 02, 2026 - 19:31 nvd

HIGH 8.2

DescriptionCVE.org

SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due to insufficient memory.

AnalysisAI

Denial-of-service in SolarWinds Web Help Desk allows remote unauthenticated attackers to crash the server by exhausting available memory. The flaw is network-reachable with low attack complexity and requires no privileges or user interaction (CVSS 8.2), and no public exploit identified at time of analysis. The issue was reported by SolarWinds and addressed in the Web Help Desk 2026.2 release.

Technical ContextAI

SolarWinds Web Help Desk is a Java-based IT service management and ticketing platform commonly deployed as an internet- or intranet-facing web application. The root cause maps to CWE-770 (Allocation of Resources Without Limits or Throttling), meaning the application accepts attacker-influenced input that drives memory allocation without enforcing an upper bound. When repeatedly or maliciously triggered, the JVM exhausts heap memory and the Web Help Desk server process crashes, taking the ticketing system offline until restarted. The single CPE entry (cpe:2.3:a:solarwinds:web_help_desk:*) indicates the vulnerability is scoped to the Web Help Desk product line rather than a shared SolarWinds component.

RemediationAI

Upgrade SolarWinds Web Help Desk to version 2026.2 or later, which per the SolarWinds release notes (https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-2_release_notes.htm) addresses this issue; consult the vendor advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28299 for any prerequisite patches or upgrade paths from older branches. Until the upgrade can be scheduled, restrict network reachability of the Web Help Desk web interface to trusted networks via firewall ACLs or VPN, and place the application behind a reverse proxy or WAF that can rate-limit and cap request body sizes to reduce the practical ability to drive memory growth - note that aggressive rate-limiting may also throttle legitimate technicians and end-users submitting large tickets or attachments. Configure JVM and OS monitoring to alert on heap pressure and auto-restart the service so an attack causes brief outages rather than prolonged downtime; this masks symptoms but does not prevent exploitation.