CISA: New SolarWinds Vulnerability Actively Exploited in the Wild

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding active exploitation of a critical vulnerability in SolarWinds Web Help Desk, urging federal agencies to patch the flaw by September 5, 2024. This vulnerability, tracked as CVE-2024-28986, is now included in CISA's Known Exploited Vulnerabilities (KEV) Catalog, indicating its active use in cyberattacks.

Discovered in SolarWinds Web Help Desk, the vulnerability concerns the deserialization of untrusted data, which could allow remote code execution on affected systems. Despite SolarWinds' inability to reproduce the exploit without authentication, the potential severity of this flaw has led the company to release an urgent patch and recommend that all users apply it immediately. The vulnerability affects versions 12.8.3 and earlier of the Web Help Desk software, with a fixed version available as 12.8.3 HF 1.

Under the Binding Operational Directive (BOD) 22-01, federal agencies are required to remediate CVE-2024-28986 by the specified deadline to protect against ongoing threats. Although this directive specifically targets Federal Civilian Executive Branch (FCEB) agencies, CISA strongly recommends that all organizations, regardless of sector, prioritize the timely remediation of this and other cataloged vulnerabilities to reduce their exposure to cyberattacks.

SolarWinds, a prominent IT management and monitoring software provider, has been at the center of several high-profile security incidents in recent years. In December 2020, its Orion software was compromised in a sophisticated supply chain attack attributed to Russian state-sponsored hackers. The breach, known as the SolarWinds hack, allowed attackers to insert malicious code into software updates, which were then distributed to thousands of customers, including U.S. federal agencies and numerous Fortune 500 companies. This incident led to widespread data breaches, significant security reviews, and increased scrutiny on software supply chain vulnerabilities, marking it as one of the most consequential cyberattacks in recent history.

The company's Web Help Desk product is widely used for IT service management, making the potential impact of this vulnerability particularly concerning. Given its high severity score of 9.8 out of 10, the flaw could enable attackers to gain unauthorized access and execute arbitrary commands, potentially leading to data breaches, system compromise, and further exploitation.

To safeguard systems, CISA urges organizations to:

• Apply the provided patch for SolarWinds Web Help Desk version 12.8.3 HF 1.
• Monitor systems for any signs of compromise.
• Consider discontinuing the use of vulnerable versions if patching is not feasible.