2026-08-01 · view entry permalink →
CVE-2026-28323 — SolarWinds Web Help Desk: unauthenticated SAML 2.0 authentication bypass on a helpdesk portal (CVSS 9.8)
SolarWinds' advisory for CVE-2026-28323 states that Web Help Desk "is found to be affected by a SAML authentication bypass vulnerability" and that exploitation "requires the SAML 2.0 authentication method to be enabled", listing the affected range as "SolarWinds Web Help Desk 2026.1 and all previous versions" and the fixed release as 2026.2.1 (SolarWinds, 2026-07-23). The same advisory record carries the severity as 9.8 Critical on the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and credits the finding to Dhabaleshwar Das (SolarWinds, 2026-07-23). The fix was not available when that advisory went out: SolarWinds' own release notes for Web Help Desk 2026.2.1 give a release date of 2026-07-30 (SolarWinds, 2026-07-30), a week after the advisory's first publication, so operators have had a patch to apply for a matter of days. A second vendor-tracked flaw is fixed in the same build. SolarWinds' dedicated advisory for CVE-2026-28299 describes a denial-of-service issue that "could cause the Web Help Desk server to crash due to insufficient memory", rates it 8.2 High on CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H — so likewise no credentials and no user interaction — lists the affected range as "SolarWinds Web Help Desk 2026.1 and all previous versions", names 2026.2.1 as the fixed release, and credits Tenable (SolarWinds, 2026-07-30). The 2026.2.1 release notes describe that same flaw differently, listing it among fixes the release "also includes ... from 2026.2" (SolarWinds, 2026-07-30). The two vendor pages disagree about whether the remediation boundary is 2026.2 or 2026.2.1; this entry records the per-CVE advisory's version, since that is the record that owns the identifier, and an operator on 2026.2 should not treat the release-notes phrasing as clearance. Switzerland's NCSC picked the advisory up on 2026-07-31, summarising the impact as "unauthenticated attackers ... bypass authentication and gain unauthorized access to the application" and recording the current exploitation status as unknown (NCSC-CH, 2026-07-31); heise reported it the same day and advised administrators to bring instances up to date promptly given the severity (heise online, 2026-07-31).
The reason this belongs on a shortlist rather than in a quarterly queue is where the product sits and how recently the fix landed, not the score. Web Help Desk is a service-desk and ticketing application, frequently published to the internet so staff and external users can raise and track tickets themselves, and an authentication bypass that needs no credentials and no user interaction turns that portal into anonymous read access to whatever the ticket store holds — the same class of platform whose compromise has repeatedly supplied attackers with credentials, internal documents and support attachments. No party reports exploitation and no proof-of-concept is public. Because the advisory withholds the mechanism, defenders cannot yet write a request-shape detection for it; that argues for closing the precondition rather than waiting to detect the attempt.
Detection concepts, telemetry class first. On any Web Help Desk instance still on an affected release, the observable to watch is in the application's own authentication and session audit trail: a session established for a user — particularly an administrative or technician role — with no matching assertion recorded on the identity-provider side, and sign-ins that do not follow the expected service-provider-initiated redirect sequence through the IdP. Correlating the application's session-creation records against the IdP's issued-assertion log for the same window is the concrete check; a session with no corresponding assertion is the discriminator, and it does not depend on knowing how the bypass is constructed. In web-access logs, requests reaching authenticated application paths without a preceding authentication transaction are the same signal one layer down. Hardening: upgrade to 2026.2.1, and where the upgrade cannot be scheduled immediately, removing the stated precondition by turning off the SAML 2.0 login method is the available lever.
SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled.
Successful exploitation allows unauthenticated attackers to bypass authentication and gain unauthorized access to the application.