SolarWinds Web Help Desk CVE-2026-28323

Exploitation requires that the SAML 2.0 authentication method be enabled on the SolarWinds Web Help Desk instance - this is the vendor-stated precondition and a non-default integration that an administrator must configure. Given the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, credentials, or user interaction are needed once SAML is enabled and the endpoint is network-reachable. Limiting factors: instances using only local or LDAP/Active Directory authentication are not affected; exposure is further reduced if the WHD interface is not reachable from untrusted networks; and the practical difficulty of forging a SAML assertion may be higher than the AC:L rating suggests, which the vendor advisory should clarify.

The signals are partially aligned but incomplete. The vendor-supplied CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a trivially reachable, unauthenticated, network-facing attack with high CIA impact, which drives the 9.8 rating. However, this is materially gated by a configuration precondition - SAML 2.0 authentication must be explicitly enabled - so environments using local or LDAP/Active Directory authentication are not exposed, making real-world reach narrower than the raw score implies. No EPSS score, SSVC decision, KEV entry, or POC was provided in the intelligence set, so exploitation probability and automatability are unknown and cannot be asserted. The CVSS AC:L rating is also arguably optimistic for a SAML bypass, which frequently requires assertion crafting or signature-wrapping knowledge; this is a point to verify against the vendor advisory. Net: treat as a high-priority patch for organizations with SAML SSO enabled on WHD, and a lower-urgency item for those without it, pending clarification of exploit complexity.

An attacker who can reach a WHD instance with SAML 2.0 SSO enabled crafts or manipulates a SAML response or assertion that WHD improperly validates, causing the application to establish an authenticated session as a chosen user without possessing valid credentials. Because the attack is network-based and requires no prior authentication or user interaction, an internet-exposed WHD portal could be compromised directly; no public POC was identified at time of analysis.