Helix Network Management CVE-2026-111283

Exploitation requires that the on-prem BMC Helix Network Management instance (versions before 26.3.01) be configured with SAML single sign-on - this is the specific, named precondition from the description and the AT:P attack requirement in the CVSS 4.0 vector. When that condition holds, no further prerequisites exist: an unauthenticated attacker with network access to the web login page submits the known local administrator username with any arbitrary password (PR:N/UI:N). The primary limiting factor is deployment mode - instances not using SAML SSO are not described as affected - plus the attacker needing network reachability to the management web interface, which in well-segmented environments should not be internet-exposed.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, and the description confirms the mechanism concretely: submitting the local administrator username with any password yields a SuperAdmin session when SAML SSO is configured. The CWE-305 (authentication bypass by primary weakness) classification aligns with the described behavior. The one mitigating signal in the vector is AT:P (a present attack requirement) - namely that SAML single sign-on must be configured - which narrows the exploitable population to that deployment mode. Severity is amplified by broad subsequent-system impact (SC:H/SI:H/SA:H): a SuperAdmin can modify device credentials, issue device commands across managed network infrastructure, and tamper with audit records, which both maximizes impact and undermines forensic detection. Key signal gaps: no EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation probability cannot be quantified from these sources. The absence of KEV/POC does not lower the intrinsic severity - the trivial, reliable exploitation path (any password) means weaponization would be straightforward if the SAML condition is met. Treat as urgent to patch wherever SAML SSO is enabled.

An attacker who can reach the BMC Helix Network Management web login page of an on-prem instance configured with SAML SSO navigates to the login form, enters the local administrator username with any arbitrary password, and is granted a SuperAdmin session. From there they modify stored device credentials, execute commands against managed network devices, and edit audit records to hide the activity. No public exploit code is identified in the provided data, but the technique requires no special tooling.