What is the CVSS score of CVE-2026-28323?

CVE-2026-28323 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of SolarWinds Web Help Desk are affected by CVE-2026-28323?

SolarWinds Web Help Desk environments configured with SAML 2.0 single sign-on are vulnerable to unauthenticated authentication bypass, allowing attackers to gain full access to support systems,…

How to fix or mitigate CVE-2026-28323?

Within 24 hours, audit all SolarWinds Web Help Desk instances for SAML 2.0 configuration and implement immediate network segmentation; if operationally feasible, disable SAML 2.0 authentication and revert to local authentication until vendor guidance is available. Within 7 days, deploy Web Application Firewall rules targeting SAML authentication endpoints with strict request validation, enable comprehensive audit logging on all help desk access and administrative functions, and enforce multi-factor authentication on all help desk administrative accounts as a compensating control. Within 30 days, establish recurring contact with SolarWinds for patch status updates, conduct forensic review of access logs for unauthorized activity during the vulnerability window, and develop a remediation timeline contingent on vendor patch release.

SolarWinds Web Help Desk CVE-2026-28323

EUVD-2026-51182 CRITICAL

Improper Authentication (CWE-287)

2026-07-30 SolarWinds

GHSA-f77h-x2x4-r498

Authentication Bypass Web Help Desk Solarwinds

9.8

CVSS 3.1 · Vendor: SolarWinds

Severity by source

Vendor (SolarWinds) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network, unauthenticated, no interaction; AC:H because forging or manipulating a SAML assertion is non-trivial and depends on the non-default SAML method, with full CIA impact from account takeover.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (SolarWinds).

CVSS VectorVendor: SolarWinds

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:51 vuln.today

CVE Published

Jul 30, 2026 - 15:55 nvd

CRITICAL 9.8

DescriptionCVE.org

SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled.

AnalysisAI

Authentication bypass in SolarWinds Web Help Desk (WHD) allows remote unauthenticated attackers to circumvent SAML 2.0 single sign-on and gain access to the application when the SAML 2.0 authentication method is enabled. The flaw (CWE-287, Improper Authentication) is rated CVSS 9.8 with full confidentiality, integrity, and availability impact, meaning a successful bypass yields authenticated-level access to help desk data and administrative functions. No public exploit identified at time of analysis and it is not listed in CISA KEV; the high score reflects the pre-authentication network reachability of the SAML endpoint rather than confirmed in-the-wild activity.

Technical ContextAI

SolarWinds Web Help Desk is a Java-based IT service management and ticketing platform commonly deployed as an on-premises web application (CPE cpe:2.3:a:solarwinds:web_help_desk:*). The vulnerability lies in the SAML 2.0 authentication integration, an SSO standard in which an external Identity Provider issues signed XML assertions that the Service Provider (WHD) validates to establish a trusted session. CWE-287 (Improper Authentication) as the root class indicates WHD fails to correctly verify the authenticity or integrity of the SAML assertion or response - the family of flaws that includes missing or improper signature validation, XML signature wrapping, or acceptance of assertions not bound to the expected Identity Provider - permitting an attacker to forge or manipulate authentication material and be treated as a legitimate, authenticated user.

RemediationAI

Upgrade SolarWinds Web Help Desk to the fixed release referenced in the vendor advisory - the WHD 2026.2.1 release notes are cited as the remediation reference (https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-2-1_release_notes.htm); confirm the exact patched version and applicability in the official advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28323. If immediate patching is not possible, the most direct compensating control is to disable the SAML 2.0 authentication method and fall back to local or LDAP/Active Directory authentication, which fully removes the vulnerable code path but disrupts SSO login for users and requires alternate credential provisioning. As an interim measure, restrict network access to the WHD web interface and its SAML assertion consumer endpoint to trusted networks or via VPN to reduce unauthenticated internet exposure, and review the SolarWinds secure configuration guidance (https://documentation.solarwinds.com/en/success_center/whd/content/helpdesksecureconfiguration.htm); note that network restriction does not fix the underlying assertion-validation flaw for reachable insiders.