Loading story…
SolarWinds has patched a critical authentication bypass flaw in Web Help Desk that could allow unauthenticated attackers to access vulnerable instances when SAML 2.0 single sign-on is enabled. Tracked as CVE-2026-28323, the issue affects Web Help Desk 2026.1 and earlier and is classified under CWE-287. SolarWinds rated the bug CVSS 9.8, with impact spanning confidentiality, integrity, and availability, raising the risk of exposure of help desk tickets, user data, internal communications, and IT asset records.
The fix was released in Web Help Desk 2026.2.1, and SolarWinds said it has not disclosed exploit details or observed active exploitation. The same release also addresses CVE-2026-28299, a high-severity denial-of-service vulnerability, along with multiple pgAdmin issues. Organizations using SAML-based SSO on Web Help Desk have been urged to upgrade immediately, verify authentication behavior after patching, and review logs for signs of unauthorized access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
SolarWinds fixed the SAML authentication bypass vulnerability CVE-2026-28323 in Web Help Desk version 2026.2.1. The release on July 30, 2026 also addressed CVE-2026-28299 and multiple pgAdmin vulnerabilities.
A newly received CVE record identified CVE-2026-28323 as a SAML authentication bypass affecting SolarWinds Web Help Desk 2026.1 and earlier when SAML 2.0 authentication is enabled. The vulnerability was assigned CWE-287 and a CVSS v3.1 vector indicating high impact to confidentiality, integrity, and availability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds released **Web Help Desk 2026.2.1** to fix two vulnerabilities affecting the help desk platform: **`CVE-2026-28323`**, a critical authentication-bypass flaw, and **`CVE-2026-28299`**, a high-severity denial-of-service issue. The authentication-bypass bug affects deployments with **SAML 2.0** enabled and could allow a remote unauthenticated attacker to craft or relay a malicious `SAMLResponse` and establish a session without valid credentials. The denial-of-service flaw can be triggered through unauthenticated interaction with a Web Help Desk endpoint, potentially causing resource exhaustion and service crashes. Security guidance accompanying the release said no active exploitation had been observed, but warned that Web Help Desk is frequently internet-facing and that the no-credentials requirement makes the authentication bypass a likely target. Organizations were urged to patch immediately, disable **SAML 2.0** if patching is delayed, enforce MFA through an identity provider or VPN/ZTNA, protect SAML endpoints with WAF or reverse-proxy controls, and reduce public internet exposure. SolarWinds also announced that **Web Help Desk 12.8.8 and earlier** will lose engineering support and reach final end of life later in 2026, increasing pressure on customers running legacy versions to upgrade.
Aug 7, 2026
SolarWinds released a security update for **Web Help Desk 2026.1 and all previous versions** to remediate **`CVE-2026-28299`**, a network-exploitable denial-of-service vulnerability. According to the vendor notice cited by EG-FinCIRT, the flaw has **low attack complexity** and can be triggered **without privileges or user interaction**, increasing the risk of opportunistic exploitation against exposed systems. Successful exploitation could exhaust memory, crash the Web Help Desk server, and disrupt service availability. Organizations using SolarWinds Web Help Desk were urged to validate and deploy the update as soon as testing is complete to reduce the risk of outages caused by unauthenticated attacks.
Jul 8, 2026
SolarWinds issued another fix for **Web Help Desk** after attackers were found exploiting a patch bypass that left a previously addressed vulnerability still reachable. The report says the flaw was being actively exploited, forcing the company to reissue remediation guidance and update customers again to close the bypass condition. The incident highlights the operational risk of incomplete vulnerability remediation, where an initial patch can be circumvented and exposed systems remain vulnerable despite prior updates. Organizations running Web Help Desk were urged to apply the latest vendor fix immediately and verify that earlier mitigations had not left the product exposed to continued exploitation.
Jun 29, 2026