What is the CVSS score of EUVD-2026-51182?

EUVD-2026-51182 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of SolarWinds Web Help Desk are affected by EUVD-2026-51182?

SolarWinds Web Help Desk environments configured with SAML 2.0 single sign-on are vulnerable to unauthenticated authentication bypass, allowing attackers to gain full access to support systems,…

How to fix or mitigate EUVD-2026-51182?

Within 24 hours, audit all SolarWinds Web Help Desk instances for SAML 2.0 configuration and implement immediate network segmentation; if operationally feasible, disable SAML 2.0 authentication and revert to local authentication until vendor guidance is available. Within 7 days, deploy Web Application Firewall rules targeting SAML authentication endpoints with strict request validation, enable comprehensive audit logging on all help desk access and administrative functions, and enforce multi-factor authentication on all help desk administrative accounts as a compensating control. Within 30 days, establish recurring contact with SolarWinds for patch status updates, conduct forensic review of access logs for unauthorized activity during the vulnerability window, and develop a remediation timeline contingent on vendor patch release.

SolarWinds Web Help Desk EUVD-2026-51182

| CVE-2026-28323 CRITICAL

Improper Authentication (CWE-287)

2026-07-30 SolarWinds

GHSA-f77h-x2x4-r498

Authentication Bypass Web Help Desk

9.8

CVSS 3.1 · Vendor: SolarWinds

Severity by source

Vendor (SolarWinds) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network, unauthenticated, no interaction; AC:H because forging or manipulating a SAML assertion is non-trivial and depends on the non-default SAML method, with full CIA impact from account takeover.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (SolarWinds).

CVSS VectorVendor: SolarWinds

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 16:51 vuln.today

CVE Published

Jul 30, 2026 - 15:55 nvd

CRITICAL 9.8

DescriptionCVE.org

SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled.

AnalysisAI

Authentication bypass in SolarWinds Web Help Desk (WHD) allows remote unauthenticated attackers to circumvent SAML 2.0 single sign-on and gain access to the application when the SAML 2.0 authentication method is enabled. The flaw (CWE-287, Improper Authentication) is rated CVSS 9.8 with full confidentiality, integrity, and availability impact, meaning a successful bypass yields authenticated-level access to help desk data and administrative functions. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Reach WHD SAML endpoint over network

Delivery

Forge or manipulate SAML 2.0 assertion

Exploit

Bypass improper assertion validation

Execution

Establish authenticated session

Impact

Access help desk data and admin functions

Access

Reach WHD SAML endpoint over network

Delivery

Forge or manipulate SAML 2.0 assertion

Exploit

Bypass improper assertion validation

Execution

Establish authenticated session

Impact

Access help desk data and admin functions

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the SAML 2.0 authentication method be enabled on the SolarWinds Web Help Desk instance - this is the vendor-stated precondition and a non-default integration that an administrator must configure. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals are partially aligned but incomplete. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can reach a WHD instance with SAML 2.0 SSO enabled crafts or manipulates a SAML response or assertion that WHD improperly validates, causing the application to establish an authenticated session as a chosen user without possessing valid credentials. Because the attack is network-based and requires no prior authentication or user interaction, an internet-exposed WHD portal could be compromised directly; no public POC was identified at time of analysis.
Remediation	Upgrade SolarWinds Web Help Desk to the fixed release referenced in the vendor advisory - the WHD 2026.2.1 release notes are cited as the remediation reference (https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-2-1_release_notes.htm); confirm the exact patched version and applicability in the official advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28323. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, audit all SolarWinds Web Help Desk instances for SAML 2.0 configuration and implement immediate network segmentation; if operationally feasible, disable SAML 2.0 authentication and revert to local authentication until vendor guidance is available. …

Threat intelligence, references, and detailed analysis are available after sign-in.