Loading story…
SolarWinds released a security update for Web Help Desk 2026.1 and all previous versions to remediate CVE-2026-28299, a network-exploitable denial-of-service vulnerability. According to the vendor notice cited by EG-FinCIRT, the flaw has low attack complexity and can be triggered without privileges or user interaction, increasing the risk of opportunistic exploitation against exposed systems.
Successful exploitation could exhaust memory, crash the Web Help Desk server, and disrupt service availability. Organizations using SolarWinds Web Help Desk were urged to validate and deploy the update as soon as testing is complete to reduce the risk of outages caused by unauthenticated attacks.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
On 2026-06-04, SolarWinds released a security update for SolarWinds Web Help Desk 2026.1 and all previous versions to remediate CVE-2026-28299, a network-exploitable denial-of-service vulnerability. The flaw could exhaust memory, crash the Web Help Desk server, and cause denial-of-service conditions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds has patched a critical authentication bypass flaw in **Web Help Desk** that could allow unauthenticated attackers to access vulnerable instances when **SAML 2.0** single sign-on is enabled. Tracked as `CVE-2026-28323`, the issue affects **Web Help Desk 2026.1 and earlier** and is classified under `CWE-287`. SolarWinds rated the bug **CVSS 9.8**, with impact spanning confidentiality, integrity, and availability, raising the risk of exposure of help desk tickets, user data, internal communications, and IT asset records. The fix was released in **Web Help Desk 2026.2.1**, and SolarWinds said it has not disclosed exploit details or observed active exploitation. The same release also addresses `CVE-2026-28299`, a high-severity denial-of-service vulnerability, along with multiple **pgAdmin** issues. Organizations using SAML-based SSO on Web Help Desk have been urged to upgrade immediately, verify authentication behavior after patching, and review logs for signs of unauthorized access.
Jul 31, 2026
SolarWinds released **Web Help Desk 2026.2.1** to fix two vulnerabilities affecting the help desk platform: **`CVE-2026-28323`**, a critical authentication-bypass flaw, and **`CVE-2026-28299`**, a high-severity denial-of-service issue. The authentication-bypass bug affects deployments with **SAML 2.0** enabled and could allow a remote unauthenticated attacker to craft or relay a malicious `SAMLResponse` and establish a session without valid credentials. The denial-of-service flaw can be triggered through unauthenticated interaction with a Web Help Desk endpoint, potentially causing resource exhaustion and service crashes. Security guidance accompanying the release said no active exploitation had been observed, but warned that Web Help Desk is frequently internet-facing and that the no-credentials requirement makes the authentication bypass a likely target. Organizations were urged to patch immediately, disable **SAML 2.0** if patching is delayed, enforce MFA through an identity provider or VPN/ZTNA, protect SAML endpoints with WAF or reverse-proxy controls, and reduce public internet exposure. SolarWinds also announced that **Web Help Desk 12.8.8 and earlier** will lose engineering support and reach final end of life later in 2026, increasing pressure on customers running legacy versions to upgrade.
Aug 7, 2026
SolarWinds issued another fix for **Web Help Desk** after attackers were found exploiting a patch bypass that left a previously addressed vulnerability still reachable. The report says the flaw was being actively exploited, forcing the company to reissue remediation guidance and update customers again to close the bypass condition. The incident highlights the operational risk of incomplete vulnerability remediation, where an initial patch can be circumvented and exposed systems remain vulnerable despite prior updates. Organizations running Web Help Desk were urged to apply the latest vendor fix immediately and verify that earlier mitigations had not left the product exposed to continued exploitation.
Jun 29, 2026