Loading story…
SolarWinds Web Help Desk (WHD) contains CVE-2026-28323, a critical CVSS 9.8 authentication-bypass flaw affecting WHD 2026.1 and earlier when SAML 2.0 authentication is enabled. An unauthenticated attacker can submit a forged, unsigned SAML response naming an existing WHD user and receive an authenticated session as that user, potentially including a WHD administrator.
The issue stems from conditional signature verification, acceptance of unsigned assertions, and missing SAML validation checks in legacy OpenSAML 2.x handling. SolarWinds fixed the vulnerability in WHD 2026.2.1 by adopting Spring Security's SAML2 service-provider implementation; organizations should upgrade promptly or disable SAML authentication until patching is complete.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
SolarWinds released Web Help Desk 2026.2.1 to remediate CVE-2026-28323, an authentication-bypass flaw in SAML 2.0 processing. The release also fixed CVE-2026-28299, a denial-of-service vulnerability.
CISA added the separate SolarWinds Web Help Desk vulnerability CVE-2026-28318 to its Known Exploited Vulnerabilities catalog.
CVE-2026-28323 affects SolarWinds Web Help Desk 2026.1 and earlier when SAML 2.0 is enabled. Forged unsigned SAML responses can authenticate as an existing account, potentially including an administrator, because the vulnerable implementation conditionally accepted unsigned assertions and omitted required SAML validations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds released **Web Help Desk 2026.2.1** to fix two vulnerabilities affecting the help desk platform: **`CVE-2026-28323`**, a critical authentication-bypass flaw, and **`CVE-2026-28299`**, a high-severity denial-of-service issue. The authentication-bypass bug affects deployments with **SAML 2.0** enabled and could allow a remote unauthenticated attacker to craft or relay a malicious `SAMLResponse` and establish a session without valid credentials. The denial-of-service flaw can be triggered through unauthenticated interaction with a Web Help Desk endpoint, potentially causing resource exhaustion and service crashes. Security guidance accompanying the release said no active exploitation had been observed, but warned that Web Help Desk is frequently internet-facing and that the no-credentials requirement makes the authentication bypass a likely target. Organizations were urged to patch immediately, disable **SAML 2.0** if patching is delayed, enforce MFA through an identity provider or VPN/ZTNA, protect SAML endpoints with WAF or reverse-proxy controls, and reduce public internet exposure. SolarWinds also announced that **Web Help Desk 12.8.8 and earlier** will lose engineering support and reach final end of life later in 2026, increasing pressure on customers running legacy versions to upgrade.
Aug 7, 2026
SolarWinds has patched a critical authentication bypass flaw in **Web Help Desk** that could allow unauthenticated attackers to access vulnerable instances when **SAML 2.0** single sign-on is enabled. Tracked as `CVE-2026-28323`, the issue affects **Web Help Desk 2026.1 and earlier** and is classified under `CWE-287`. SolarWinds rated the bug **CVSS 9.8**, with impact spanning confidentiality, integrity, and availability, raising the risk of exposure of help desk tickets, user data, internal communications, and IT asset records. The fix was released in **Web Help Desk 2026.2.1**, and SolarWinds said it has not disclosed exploit details or observed active exploitation. The same release also addresses `CVE-2026-28299`, a high-severity denial-of-service vulnerability, along with multiple **pgAdmin** issues. Organizations using SAML-based SSO on Web Help Desk have been urged to upgrade immediately, verify authentication behavior after patching, and review logs for signs of unauthorized access.
Jul 31, 2026
SolarWinds released security updates for *Web Help Desk (WHD)* to address multiple critical vulnerabilities that could allow **unauthenticated remote attackers** to bypass authentication and achieve **remote code execution (RCE)**. The patched issues include two critical authentication bypass flaws, **CVE-2025-40552** and **CVE-2025-40554** (reported by watchTowr researcher Piotr Bazydlo), and two critical RCE flaws tied to **untrusted data deserialization**, **CVE-2025-40553** (Bazydlo) and **CVE-2025-40551** (reported by Horizon3.ai researcher Jimi Sebree), enabling remote command execution without prior access. SolarWinds also fixed a high-severity **hardcoded credentials** issue, **CVE-2025-40537**, which could enable unauthorized access to administrative functions under certain conditions. The vendor advised administrators to upgrade to **Web Help Desk 2026.1** and patch quickly, noting WHD has a history of being targeted and previously had vulnerabilities flagged as actively exploited by CISA, reinforcing the likelihood of rapid attacker interest following disclosure and patch availability.
Jun 29, 2026