CVE-2026-28323

This is a flaw in the Web Help Desk sign-in process that can let someone enter without proving who they are. It is like a front desk accepting a forged visitor pass and then handing the visitor the master keys to the office.

This matters to you if you run Web Help Desk and use SAML 2.0 for employee sign-in. It is only a risk when SAML 2.0 authentication is enabled on the instance.

An attacker can gain full access remotely through the sign-in process, making this a red-priority issue. No real-world exploitation or public exploit code has been reported, but do not leave an affected SAML-enabled system unaddressed.

Confirm whether SAML 2.0 is enabled in Web Help Desk’s authentication configuration and record the installed version. SolarWinds identifies 2026.2.1 as the fixed release; upgrade the instance to that version using the vendor’s documented Web Help Desk upgrade process and test SAML sign-in afterward. No separate fixed-version branches were provided. If the upgrade must wait, disable SAML 2.0 authentication, because it is the stated precondition for the bypass, and use an approved alternative sign-in method. CISA has not added this CVE to the Known Exploited Vulnerabilities catalog, so there is no CISA remediation due date. After remediation, review authentication and administrator activity for unexpected access or configuration changes.

CVE-2026-28323 is rated CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-287, Improper Authentication. It is a network-reachable, unauthenticated authentication bypass in SAML 2.0 login-request handling; SAML 2.0 must be enabled. CISA KEV does not list the CVE, no dated in-the-wild exploitation claim is available, and no public exploit code is on record. EPSS is 0.7% at the 50th percentile with a flat trend.