SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability.

CVE-2026-28323 is a SAML authentication bypass in SolarWinds Web Help Desk (WHD) affecting all versions prior to 2026.2.1. The flaw lies in how WHD validates SAML 2.0 authentication responses — an attacker who can reach the WHD login endpoint can forge a SAML assertion and impersonate any user, including administrators, without valid credentials. The bug is unauthenticated and network-reachable, earning its CVSS:3.1 9.8 score. Researcher Dhabaleshwar Das responsibly disclosed it, and SolarWinds shipped version 2026.2.1 on July 30, 2026 — just two days ago.

The vendor's CRITICAL/9.8 rating is *technically correct for the configured-SAML case* but overstates the population-level risk. The vulnerability only fires when SAML 2.0 SSO is enabled — WHD deployments using local authentication, LDAP, or Active Directory native auth are unaffected. That said, SolarWinds WHD has a grim recent history: CVE-2025-40551 hit CISA's KEV catalog in February 2026, and Microsoft documented multi-stage intrusions where WHD was the beachhead for full Active Directory compromise via DCSync. Attackers already have WHD in their target lists. A SAML bypass PoC for this class of bug is typically straightforward to develop, so the window before weaponization is short. We downgrade to HIGH 8.5 — the SAML prerequisite meaningfully narrows the blast radius, but the proven attacker interest and unauthenticated-remote attack surface keep this well above MEDIUM.

Why this verdict

• SAML prerequisite narrows population: The vulnerability only affects WHD instances with SAML 2.0 SSO configured. Deployments using local auth, LDAP bind, or AD-integrated auth are entirely unaffected. This is not captured in the CVSS vector and represents a meaningful reduction in the exposed population — estimated 30-50% of WHD deployments use SAML based on enterprise SSO adoption patterns for on-prem IT tools.
• No PoC yet, but short fuse: Disclosed 2 days ago with no public exploit code. However, SAML authentication bypass is a mature vulnerability class with extensive prior art (ruby-saml CVE-2024-45409, GitHub SAML CVE-2025-25291). Weaponization is likely within 2-4 weeks.
• Proven attacker playbook against WHD: Microsoft and Elastic documented active WHD exploitation campaigns in Feb 2026 where attackers went from WHD initial access to full AD compromise (DCSync, ntds.dit extraction). This establishes WHD as a known beachhead product. Attackers monitoring SolarWinds advisories will add this CVE to their toolkit.
• Role multiplier: WHD is a line-of-business help desk application, not a canonical high-value-role component (not an IdP, DC, hypervisor, or backup server). However, in documented real-world chains, compromised WHD servers served as the pivot point for domain-level compromise because: (a) WHD hosts sit on internal networks with AD connectivity, (b) WHD service accounts often have broad internal network access, (c) ticket data contains credentials and infrastructure intel. The blast radius when chained is domain-scale, but reaching that outcome requires either a second RCE vulnerability or abusing WHD admin features for code execution. The floor is HIGH given this proven chain.
• Unauthenticated remote attack vector: For SAML-enabled instances that are internet-facing, this is a zero-click, zero-auth bypass. No credential stuffing, no phishing — just a crafted HTTP POST. This keeps severity firmly in HIGH territory.

Why not higher?

CRITICAL would require the vulnerability to affect the full WHD installed base or for the affected component to canonically occupy a high-value role. WHD is a help desk tool, not an identity provider or domain controller. The SAML prerequisite materially narrows the vulnerable population — a non-trivial fraction of WHD instances simply cannot be exploited via this bug. Additionally, there is no public PoC and no confirmed in-the-wild exploitation of *this specific CVE* yet.

Why not lower?

MEDIUM would ignore the proven attacker interest in SolarWinds WHD (KEV-listed sibling CVEs, documented domain-compromise chains), the unauthenticated-remote attack surface, and the short expected timeline to weaponization. WHD has been a repeatedly targeted product in 2025-2026 campaigns. Any SAML-enabled, internet-facing WHD instance is one crafted POST away from full admin compromise, and the historical pattern shows attackers chain WHD access into AD takeover.

1. Disable SAML SSO immediately on WHD if not operationally required — Switching to LDAP or local authentication completely eliminates this attack vector. If SAML is optional in your environment, disable it within the noisgate mitigation SLA of 30 days (HIGH verdict). This is the most effective compensating control available.
2. Restrict WHD network exposure to VPN or internal-only — Remove WHD from public-facing network segments. Place it behind VPN, ZTNA, or IP-allowlisted reverse proxy. This eliminates the unauthenticated remote attack path for external adversaries. Deploy within 30 days per noisgate mitigation SLA.
3. Deploy IdP-side anomaly detection for SAML assertion mismatches — Configure your IdP (Okta, Azure AD, ADFS) to log all SAML assertions issued. Set up SIEM alerts for any WHD admin session that lacks a corresponding IdP-side assertion — this is a high-fidelity indicator of forged SAML responses.
4. Audit WHD service account privileges and network segmentation — Reduce the WHD service account's network access to only required endpoints (database, SMTP). Block WHD host from reaching domain controllers, ADCS, or other Tier 0 assets directly. This limits the blast radius if WHD is compromised.
5. Monitor WHD host for post-exploitation TTPs — Deploy or verify EDR coverage on the WHD server. Alert on java.exe spawning cmd.exe, powershell.exe, or any child process. Watch for RMM tool installation, Defender disablement, and scheduled task creation — all TTPs observed in Feb 2026 WHD campaigns.

Run this script on the WHD server (Linux) or from any host with curl access to the WHD instance. Invoke as: bash check_cve_2026_28323.sh https://whd.example.com. Requires no special privileges — it only checks the installed version via the WHD login page.

#!/bin/bash
# check_cve_2026_28323.sh — Check SolarWinds WHD for CVE-2026-28323 exposure
# Usage: bash check_cve_2026_28323.sh <WHD_BASE_URL>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 1 ]; then
  echo "Usage: $0 <WHD_BASE_URL>"
  echo "Example: $0 https://whd.example.com"
  exit 2
fi

WHD_URL="${1%/}"
FIXED_MAJOR=2026
FIXED_MINOR=2
FIXED_PATCH=1

echo "[*] Checking SolarWinds WHD at: $WHD_URL"

# Attempt to grab version from the login page or API
RESPONSE=$(curl -sk --max-time 10 "$WHD_URL/helpdesk/WebObjects/Helpdesk.woa" 2>/dev/null || true)

if [ -z "$RESPONSE" ]; then
  echo "[!] Could not reach WHD instance at $WHD_URL"
  echo "UNKNOWN"
  exit 2
fi

# Try to extract version string from page content
VERSION=$(echo "$RESPONSE" | grep -oP 'Web Help Desk\s+v?\K[0-9]+\.[0-9]+\.[0-9]+' | head -1)

if [ -z "$VERSION" ]; then
  # Try alternative version extraction from headers or other endpoints
  VERSION=$(curl -sk --max-time 10 "$WHD_URL/helpdesk/WebObjects/Helpdesk.woa/wa/VersionAction" 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
fi

if [ -z "$VERSION" ]; then
  echo "[!] Could not determine WHD version. Check manually."
  echo "[*] Checking if SAML SSO is configured..."
  if echo "$RESPONSE" | grep -qi 'saml\|sso\|single.sign'; then
    echo "[!] SAML/SSO references detected on login page — instance may be vulnerable if unpatched."
  else
    echo "[*] No SAML/SSO references detected on login page — instance may not be affected."
  fi
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Detected WHD version: $VERSION"

IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# Compare versions
if [ "$MAJOR" -gt "$FIXED_MAJOR" ] 2>/dev/null; then
  echo "PATCHED — version $VERSION >= $FIXED_MAJOR.$FIXED_MINOR.$FIXED_PATCH"
  exit 0
elif [ "$MAJOR" -eq "$FIXED_MAJOR" ] 2>/dev/null; then
  if [ "$MINOR" -gt "$FIXED_MINOR" ] 2>/dev/null; then
    echo "PATCHED — version $VERSION >= $FIXED_MAJOR.$FIXED_MINOR.$FIXED_PATCH"
    exit 0
  elif [ "$MINOR" -eq "$FIXED_MINOR" ] 2>/dev/null; then
    if [ "$PATCH" -ge "$FIXED_PATCH" ] 2>/dev/null; then
      echo "PATCHED — version $VERSION >= $FIXED_MAJOR.$FIXED_MINOR.$FIXED_PATCH"
      exit 0
    fi
  fi
fi

echo "VULNERABLE — version $VERSION is below fixed version $FIXED_MAJOR.$FIXED_MINOR.$FIXED_PATCH"
echo "[*] CVE-2026-28323: SAML authentication bypass. Upgrade to WHD 2026.2.1 or later."
exit 1

Sources

1. GBHackers — Critical SolarWinds WHD SAML Bypass
2. Arctic Wolf — Multiple Critical WHD Vulnerabilities
3. Microsoft — Active Exploitation of SolarWinds WHD (Feb 2026)
4. Elastic Security Labs — SolarWinds WHD Exploitation (Feb 2026)
5. The Hacker News — CISA Adds WHD RCE to KEV
6. Cryptika — SolarWinds SAML Login Bypass
7. CyCognito — SolarWinds WHD Vulnerabilities Update
8. Datanyze — SolarWinds WHD Market Share