{"id":"CVE-2026-28323","published":"2026-07-30T15:55:29Z","modified":"2026-07-31T03:56:15Z","title":"SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability","vendor":"SolarWinds","product":"Web Help Desk","tier":"core","eol":null,"affectedVersions":[{"vendor":"SolarWinds","product":"Web Help Desk","versions":["2026.1 and all previous versions"]}],"description":{"text":"SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled.","provenance":"source","from":"CVE.org"},"summary":{"text":"SolarWinds Web Help Desk contains a SAML authentication bypass flaw in its SAML 2.0 authentication handling, which is only present when that authentication method is enabled. An attacker with network access, requiring no privileges and no user interaction, can bypass authentication through the SAML flow to gain unauthorised access to the application.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:37Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01026,"percentile":0.63622,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28323","tags":["vendor-advisory"]},{"url":"https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-2-1_release_notes.htm","tags":["release-notes"]},{"url":"https://documentation.solarwinds.com/en/success_center/whd/content/helpdesksecureconfiguration.htm","tags":["x_secure-configuration-guide"]}],"techniques":[],"reports":[{"id":"SRC-785c287ab8311e1ba46a","title":"From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services","publisher":"arcticwolf.com","url":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/","date":"2026-06-02","mentions":[{"quote":"Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass Vulnerabilities Require Immediate PatchingVIEW","start":5225,"end":5539}]},{"id":"SRC-6a06d5ec9ab99e8b6b36","title":"Token Bingo: Don't Let Your Code be the Winner","publisher":"arcticwolf.com","url":"https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/","date":"2026-04-24","mentions":[{"quote":"Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass Vulnerabilities Require Immediate PatchingVIEW","start":5135,"end":5449}]},{"id":"SRC-876a8c22e3a8316f7dab","title":"Dropping Elephant APT Group Targets Turkish Defense Industry With New Campaign and Capabilities: LOLBAS, VLC Player, and Encrypted Shellcode","publisher":"arcticwolf.com","url":"https://arcticwolf.com/resources/blog/dropping-elephant-apt-group-targets-turkish-defense-industry/","date":"2025-07-23","mentions":[{"quote":"Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass Vulnerabilities Require Immediate PatchingVIEW","start":5229,"end":5543}]},{"id":"SRC-4cf3172d190519e868ee","title":"Blog | Arctic Wolf","publisher":"arcticwolf.com","url":"https://arcticwolf.com/resources/blog/","date":null,"mentions":[{"quote":"Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass Vulnerabilities Require Immediate PatchingVIEW","start":5093,"end":5407},{"quote":"SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299","start":8597,"end":8672}]},{"id":"SRC-1b0b8c4d77ff85ee9833","title":"Ending Cyber Risk with Aurora Endpoint Security","publisher":"arcticwolf.com","url":"https://arcticwolf.com/cylance/","date":null,"mentions":[{"quote":"Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass Vulnerabilities Require Immediate PatchingVIEW","start":5136,"end":5450}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-51182","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-51182","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-07-23","kind":"report","label":"Named in arcticwolf.com: Dropping Elephant APT Group Targets Turkish Defense Industry With New Campaign and Capabilitie…","url":"https://arcticwolf.com/resources/blog/dropping-elephant-apt-group-targets-turkish-defense-industry/","provenance":"machine"},{"date":"2026-04-24","kind":"report","label":"Named in arcticwolf.com: Token Bingo: Don't Let Your Code be the Winner","url":"https://arcticwolf.com/resources/blog/token-bingo-dont-let-your-code-be-the-winner/","provenance":"machine"},{"date":"2026-06-02","kind":"report","label":"Named in arcticwolf.com: From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook,…","url":"https://arcticwolf.com/resources/blog/kali365-expands-into-aws-microsoft-okta-xerox-max-messenger/","provenance":"machine"},{"date":"2026-07-30","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-28323","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":29.6,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":12.72,"detail":"percentile 0.6362"},{"name":"Named in threat reports","points":10.0,"detail":"5 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}