CVE-2026-28299: SolarWinds Web Help Desk Denial-of-Service Vulnerability – CVSS 8.2

Technical summary

CVE-2026-28299 is a resource-exhaustion vulnerability (CWE-770: Allocation of Resources Without Limits or Throttling) in SolarWinds Web Help Desk. The flaw permits unauthenticated network-based attackers to send specially crafted requests that cause the application server to allocate memory without proper constraints, eventually triggering an out-of-memory condition that crashes the service. The CVSS 3.1 score of 8.2 (HIGH) reflects high availability impact and low attack complexity, with no privilege or user-interaction requirements.

Business impact

Web Help Desk is often a critical operational service for IT support teams. Exploitation forces service unavailability, preventing staff from logging tickets, accessing knowledge bases, or managing support workflows. This can cascade into delayed incident response, frustrated end-users, and potential SLA violations. Organizations dependent on integrated help desk operations should expect operational disruption and potential downstream effects on IT service delivery.

Affected systems

SolarWinds Web Help Desk deployments are affected. The vulnerability impacts the application server itself and can be triggered from any network position without credentials. Both on-premises and hosted instances running vulnerable versions are at risk. Verify your installed version against SolarWinds' advisory to confirm scope within your environment.

Exploitability

The attack surface is broad and the barrier to exploitation is low. No authentication, valid user account, or complex manipulation is required. An attacker simply needs network access to the Web Help Desk interface and can trigger the denial-of-service condition with relative ease. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates an attack is feasible from the Internet without special conditions. This is not an in-the-wild exploit scenario flagged for active exploitation, but the technical characteristics make it a realistic threat if left unpatched.

Remediation

Apply the security patch released by SolarWinds for this vulnerability as soon as feasible. Verify the patched version number against the vendor advisory. Until patching is complete, restrict network access to Web Help Desk—use firewall rules, VPN requirements, or IP whitelisting to limit who can reach the application from outside your trusted network. Monitor server resource utilization for signs of memory exhaustion attacks.

Patch guidance

Check SolarWinds' official security advisory for the exact patch version and installation instructions for your deployment model (on-premises vs. hosted). Apply patches during a maintenance window to minimize help desk downtime. Test in a staging environment if possible before production deployment. Verify the patch is installed by confirming the application version matches the advisory recommendation and restart services if required.

Detection guidance

Monitor Web Help Desk server logs and system metrics for repeated failed requests, unusual memory consumption spikes, or unexpected service crashes. Network-based detection is challenging without signature updates; focus on endpoint observability. Track server-side resource exhaustion patterns and correlate crashes with inbound traffic patterns. Alert on sustained high memory usage or application restarts. Log aggregation tools can help correlate crash events with suspicious request patterns.

Why prioritize this

Although this vulnerability is not yet in the CISA KEV catalog, the high CVSS score (8.2), ease of exploitation (no auth required, network-accessible), and direct impact on availability make it a priority for rapid remediation. Help desk systems are operational dependencies; taking them offline creates tangible business harm. Organizations should prioritize patching Web Help Desk ahead of lower-severity, harder-to-exploit flaws.

Risk score, explained

The CVSS 3.1 score of 8.2 reflects the combination of network-based attack vector, low complexity, no privilege or user interaction requirements, and high availability impact. While confidentiality and integrity are not compromised, the assured denial-of-service capability and ease of trigger warrant a HIGH severity classification. The score appropriately captures the operational risk to business-critical help desk infrastructure.

Frequently asked questions