CVE-2026-28323Patch(solarwinds / web_help_desk)

MEDIUMCVSS 9.8 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch solarwinds web_help_desk systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled.

solarwinds CVEs Back to dashboard

5.8/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

https://documentation.solarwinds.com/en/success_center/whd/content/helpdesksecureconfiguration.htm

Weakness type (CWE)

CWE-287

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

web_help_desk

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
18 mentions across 12 observed days

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 10 signals
Technical details provided in 14 signals
Disclosure: 4 classified signals
General: 3 classified signals
Peaked 10d ago at 3 mentions (2026-07-31); latest day: 1
18 total mentions across 12 days

Affected systems

Vendors

solarwinds

Products

web_help_desk

Deep dive

Activity timeline18 mentions / 12d

Signal classification6 categories

Patch

844.4%

Disclosure

422.2%

General

316.7%

PoC

15.6%

Active Exploitation

15.6%

Exploit

15.6%

Referenced assets15 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-30	2	General1Patch1
2026-07-31	3	Patch3
2026-08-01	1	Patch1
2026-08-05	2	Disclosure1Patch1
2026-08-07	1	Disclosure1
2026-08-10	1	Patch1
2026-08-18	1	PoC1
2026-09-04	3	Active Exploitation1Exploit1General1
2026-09-08	1	General1
2026-09-10	1	Disclosure1
2026-09-19	1	Disclosure1
2026-09-23	1	Patch1

Full discourse18 posts

Muqsit 𝕏@mqst_49d
Disclosure
A Writeup on Analysis of CVE-2026-28323 (Signature Optional) Writeup: https://bishopfox.com/blog/signature-optional-analysis-of-cve-2026-28323 Author: @bishopfox [Ronan Kervella, Threat Enablement & Analysis Team] https://t.co/KJAtdlaB9u
Post summary
Bishop Fox released a detailed writeup analyzing CVE-2026-28323, discussing the signature‑optional nature of the flaw. No evidence of active exploitation, patch availability, or false‑positive claims is presented.
08051192.5K
13.4K followersView on X
Marcell Ujlaki@UjlakiMarci91d
Patch
say what? 🟥 CVE-2026-28323 | SolarWinds Web Help Desk, CVSS: 9.8 (#Critical) The vulnerability allows remote, unauthenticated attackers to bypass SAML authentication and achieve full system access when the SAML 2.0 authentication method is enabled. This issue impacts SolarWinds Web Help Desk version 2026.1 and all previous versions. Exploitation is contingent upon having SAML 2.0 configured and enabled within the application. Administrators should review the vendor advisory and apply the latest available patches or updates to secure affected deployments. https://documentation.solarwinds.com/en/success_center/whd/content/helpdesksecureconfiguration.htm
Post summary
SolarWinds Web Help Desk is vulnerable to a critical SAML authentication bypass allowing remote, unauthenticated attackers full system access; apply vendor patches or updates immediately.
10021190
359 followersView on X
CCB Alert@CCBalert85d
Patch
Warning: Critical vulnerability in #SolarWinds Web Help Desk, #CVE-2026-28323 (CVSS 9.8). Unauthenticated attackers can bypass SAML authentication when SAML 2.0 authentication method is enabled! #Patch #Patch #Patch More info: https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28323
Post summary
The post alerts to CVE‑2026‑28323, a CVSS 9.8 SAML authentication bypass in SolarWinds Web Help Desk, and directs readers to a patch via the vendor advisory.
01100520
7.2K followersView on X
Daily CyberSecurity@Daily_CyberSec91d
Patch
A SolarWinds Web Help Desk SAML authentication bypass, CVE-2026-28323, scores a critical CVSS 9.8. Update to 2026.2.1 to stay protected. #SolarWinds #WebHelpDesk #CVE202628323 #SAML #InfoSec http://securityonline.info/solarwinds-web-help-desk-saml-bypass/
Post summary
The post highlights a critical SAML authentication bypass in SolarWinds Web Help Desk (CVE-2026-28323) with a CVSS 9.8 score and recommends updating to version 2026.2.1 for protection.
01010431
12.6K followersView on X
DFIR Radar@DFIR_Radar56d
Exploit
CVE-2026-28323 in SolarWinds Web Help Desk allows full session takeover via a single forged SAML POST, no credentials required. Bishop Fox confirmed end-to-end exploitation. Key findings: - SolarWinds Web Help Desk treated SAML signature verification as optional and skipped all remaining spec-required validation steps, meaning an attacker could forge an arbitrary SAML assertion and the application accepted it as legitimate. - Bishop Fox confirmed the full exploit chain end to end: one crafted POST request with a forged SAML response, zero credentials, full authenticated session returned. No chained CVEs, no prior foothold needed. Exploitation is trivially reproducible. - DFIR artifact focus: hunt your web server access logs for POST requests to the SAML assertion consumer service endpoint with malformed or unsigned SAMLResponse values, especially those resulting in HTTP 200 or redirect responses that indicate session creation. - Scope: any SolarWinds Web Help Desk deployment with SAML SSO enabled is affected until the patch is applied. Web Help Desk is common in enterprise IT and MSP environments, making this a high-value lateral movement or initial access target. Patch immediately. If patching is delayed, disable SAML SSO and fall back to local authentication. Review auth logs for unexpected SSO-authenticated sessions, particularly service or admin accounts. Full technical root cause and detection detail are in the Bishop Fox report. #DFIR_Radar
Post summary
Bishop Fox confirms that CVE‑2026‑28323 can be exploited end‑to‑end via a forged SAML POST without credentials, and the text advises immediate patching or disabling SAML SSO to mitigate the vulnerability.
10000169
1.9K followersView on X
iototsecnews@iototsecnews84d
Disclosure
SolarWinds の深刻な脆弱性 CVE-2026-28323 が FIX：SAML 認証バイパスの恐れ https://iototsecnews.jp/2026/07/31/critical-solarwinds-web-help-desk-flaw-lets-attackers-bypass-saml-authentication/ SolarWinds Web Help Desk において、シングルサインオン連携処理の不備に起因する深刻な脆弱性 CVE-2026-28323／CVE-2026-28299 が公表されました。この問題は、ログイン時の証明データに対する検証手続きの不足や、メモリ管理の不具合に起因しています。悪用された場合、第三者による不正ログインを許し、サポート窓口内の個人情報や内部情報の閲覧、あるいはサービスの応答停止が引き起こされる恐れがあります。対応策として、修正パッチが同梱された最新版への迅速な更新や、認証設定の点検が有効です。システムを安全に利用するためにも、アクセス制御を見直し、早期にバージョンアップを実施することが推奨されます。 #CVE202628323 #SolarWinds #Vulnerability
Post summary
The article discloses a critical SolarWinds Web Help Desk vulnerability (CVE‑2026‑28323 / CVE‑2026‑28299) that allows a SAML authentication bypass, potentially enabling unauthorized access or denial of service, and urges patching to the latest version.
01000201
505 followersView on X
Julio Bandeira de Melo@juliobmelo90d
Patch
SolarWinds patched CVE-2026-28323, a critical SAML authentication bypass in Web Help Desk that gives attackers access without valid credentials. CVSS 9.8. No evidence of active exploitation yet, but help desk platforms are among the most exposed enterprise surfaces. If you run Web Help Desk with SAML 2.0 SSO, upgrade to version 2026.2.1. The update also includes fixes for third-party pgAdmin RCE and command injection vulnerabilities. https://cybersecuritynews.com/solarwinds-flaw-bypass-web-help-desk-saml-login/ #CISO
Post summary
SolarWinds has patched the critical SAML authentication bypass CVE-2026-28323, advising users to upgrade to version 2026.2.1; no active exploitation has been reported.
00010313
48.8K followersView on X
TECHEPAGES@techepages91d
Patch
SolarWinds patched a high-severity DoS flaw (CVE-2026-28299, CVSS 8.2) in Web Help Desk that lets attackers crash the server via crafted requests that exhaust memory — no RCE, but enough to knock out ticketing/service workflows. The same WHD 2026.2.1 release also fixes a critical SAML auth bypass (CVE-2026-28323, CVSS 9.8) that could allow unauthorized access. The update is more than a patch — it swaps the legacy Tomcat frontend for Caddy, enforces TLS 1.2/1.3 only, adds default security headers, and stops exposing internal services to the network. Orgs running WHD should upgrade to 2026.2.1 ASAP and double-check SAML configs.
Post summary
SolarWinds announced a patch for two high‑severity CVEs in Web Help Desk, detailing a DoS flaw and a SAML bypass, and urges organizations to upgrade while noting additional security hardening in the release.
0001062
36 followersView on X
Marcell Ujlaki@UjlakiMarci91d
General
CWE-287: Improper Authentication http://cwe.mitre.org/data/definitions/287.html #EUVD: https://euvd.enisa.europa.eu/vulnerability/CVE-2026-28323 #NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-28323
Post summary
The post simply references CVE-2026-28323 with links to EUVD and NVD, offering no further details or actionable insights.
1000065
356 followersView on X
Mat Clark | ReadRoost@MathewClarkAU37d
Patch
CVE-2026-28326 hits all ARM versions up to 2026.2, fixed in 2026.2.1. No configuration workaround exists because the key is baked in. Same cycle: Web Help Desk CVE-2026-28323, a CVSS 9.8 SAML auth bypass when SAML 2.0 is enabled.
Post summary
The text announces CVE-2026-28326 (fixed in version 2026.2.1) and CVE-2026-28323 (CVSS 9.8 SAML auth bypass), naming a fixed version as remediation alongside technical vulnerability details.
0000054
24 followersView on X
NEXSIGHT@NEXSIGHTNEWS41d
Disclosure
SolarWinds Web Help DeskのSAML認証バイパス、Bishop Foxが詳細を公開 — 「証明書未設定なら検証が動かず、署名なしの応答で管理者ログインが通る」 https://cyber.nexsight.co/articles/2026/09/19/solarwinds-web-help-desk-cve-2026-28323-saml-bypass-bishopfox-2026-09-19/
Post summary
The tweet discloses CVE-2026-28323, a SAML authentication bypass in SolarWinds Web Help Desk, with technical details from Bishop Fox explaining how unsigned SAML responses can bypass admin authentication when certificates are not configured. No PoC, exploit tool, patch, or active exploitation evidence is present in the text, making Disclosure the primary classification.
0000056
74 followersView on X
IntegSec@integ_sec51d
General
CVE-2026-28323: SolarWinds Web Help Desk SAML Authentication Bypass - What It Means for Your Business and How to Respond https://hubs.li/Q04wXTYf0
Post summary
The brief headline announces CVE‑2026‑28323 and hints at business implications and response steps, but provides no technical or exploit details.
0000025
35 followersView on X
Aviatrix Threat Research Center@aviatrixtrc55d
Active Exploitation
TRC analysis shows attackers exploiting CVE-2024-28323 can forge SAML responses to gain administrative access to SolarWinds Help Desk without any credentials. Once inside, they escalate privileges and move laterally through internal systems to access sensitive corporate data. Runtime segmentation helps contain post-compromise activity when identity controls fail. #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/solarwinds-web-help-desk-cve-2026-28323-saml-bypass
Post summary
Attackers are actively exploiting CVE-2024-28323 to forge SAML responses and gain administrative access to SolarWinds Help Desk, facilitating privilege escalation and lateral movement; runtime segmentation can contain post‑compromise activity.
0000029
2.0K followersView on X
DFIR Radar@DFIR_Radar56d
General
Source: https://bishopfox.com/blog/signature-optional-analysis-of-cve-2026-28323
Post summary
The excerpt provides only a reference to a blog about CVE‑2026‑28323 but contains no explicit details, claims, or evidence related to exploitation, patches, or false positives.
0000082
1.9K followersView on X
UNDERCODE TESTING@UndercodeUpdate73d
PoC
🚨 #SolarWinds Web Help Desk #CVE-2026-28323: SAML Authentication Bypass Zero-Day Grants Unauthenticated Admin Access + Video -Prediction: 📈 2 Positive | 📉 3 Negative https://undercodetesting.com/solarwinds-web-help-desk-cve-2026-28323-saml-authentication-bypass-zero-day-grants-unauthenticated-admin-access-video/ Educational Purposes!
Post summary
The post shares a CVE-2026-28323 SAML authentication bypass vulnerability in SolarWinds Web Help Desk and supplies a video PoC, but does not indicate active exploitation, patches, or false positives.
00000142
700 followersView on X
CVETodo@CveTodo81d
Patch
SolarWinds on July 30 released fixes for a critical authentication-bypass vulnerability in its Web Help Desk software that allows a remote, unauthenticated attacker to gain a... https://cvetodo.com/news/solarwinds-patches-critical-authentication-bypass-flaw-cve-2026-28323-in-web-help-desk-no-exploit-se #Cybersecurity #InfoSec #CVE #CriticalVulnerability #RemoteCodeExecution https://t.co/qRrtieRW0t
Post summary
SolarWinds released patches on July 30 for CVE‑2026‑28323, a critical authentication‑bypass flaw in Web Help Desk that could let remote, unauthenticated attackers gain access.
0000077
19 followersView on X
Autumn Good@autumn_good_3585d
Disclosure
🚨🚨🚨 SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability (CVE-2026-28323) https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28323
Post summary
The post announces the SolarWinds Web Help Desk SAML Authentication Bypass vulnerability (CVE-2026-28323) and provides a link to the official vendor advisory.
00000478
7.0K followersView on X
The Daily Tech Feed@dailytechonx91d
Patch
SolarWinds has patched a critical SAML authentication bypass vulnerability (CVE-2026-28323) in its Web Help Desk software. Administrators are urged to update to version 2026.2.1 immediately to prevent unauthorized access. This update also addresses other security issues, including a denial-of-service flaw (CVE-2026-28299). #SolarWinds #WebHelpDesk #SAML #CyberSecurity #Vulnerability #SecurityUpdate https://thedailytechfeed.com/critical-flaw-in-solarwinds-web-help-desk-allows-saml-authentication-bypass/
Post summary
SolarWinds has issued a patch for CVE-2026-28323, a SAML authentication bypass, and urges administrators to update to version 2026.2.1 to mitigate the vulnerability.
0000072
582 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	solarwinds	web_help_desk	-	-	-

Explore more

Back to dashboard solarwinds CVEs web_help_desk vulnerabilities

What researchers are saying

CVE-2026-28323

Marcell Ujlaki[verified]@UjlakiMarciPatch

SolarWinds Web Help Desk is vulnerable to a critical SAML authentication bypass allowing remote, unauthenticated attackers full system access; apply vendor patches or updates immediately.

DFIR Radar[verified]@DFIR_RadarExploit

Bishop Fox confirms that CVE‑2026‑28323 can be exploited end‑to‑end via a forged SAML POST without credentials, and the text advises immediate patching or disabling SAML SSO to mitigate the vulnerability.

Julio Bandeira de Melo[verified]@juliobmeloPatch

SolarWinds has patched the critical SAML authentication bypass CVE-2026-28323, advising users to upgrade to version 2026.2.1; no active exploitation has been reported.

TECHEPAGES[verified]@techepagesPatch

SolarWinds announced a patch for two high‑severity CVEs in Web Help Desk, detailing a DoS flaw and a SAML bypass, and urges organizations to upgrade while noting additional security hardening in the release.

Marcell Ujlaki[verified]@UjlakiMarciGeneral

The post simply references CVE-2026-28323 with links to EUVD and NVD, offering no further details or actionable insights.

IntegSec[verified]@integ_secGeneral

The brief headline announces CVE‑2026‑28323 and hints at business implications and response steps, but provides no technical or exploit details.

Aviatrix Threat Research Center[verified]@aviatrixtrcActive Exploitation

Attackers are actively exploiting CVE-2024-28323 to forge SAML responses and gain administrative access to SolarWinds Help Desk, facilitating privilege escalation and lateral movement; runtime segmentation can contain post‑compromise activity.

DFIR Radar[verified]@DFIR_RadarGeneral

The excerpt provides only a reference to a blog about CVE‑2026‑28323 but contains no explicit details, claims, or evidence related to exploitation, patches, or false positives.