Threat reportVulnerabilityTL-2026-1789

CVE-2026-28323: SolarWinds Web Help Desk SAML Authentication Bypass

criticalTRACKING

CVE-2026-28323 (TL-2026-1789) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-07-31. It has no confirmed attribution, affects SolarWinds Web Help Desk, references 1 CVE (CVE-2026-28323), maps to 20 MITRE ATT&CK techniques (T1003, T1021, T1053), and is covered by 9 detection rules and 23 indicators of compromise.

CVSS
9.8/10Critical
CVEs
1Referenced vulnerabilities
Techniques
20MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
23Indicators of compromise

Key facts for TL-2026-1789

Threat ID
TL-2026-1789
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
TRACKING
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
information-technology, managed-service-providers, cross-sector
Target regions
Global
Detection rules
9
Indicators of compromise
23

Malware and tooling in CVE-2026-28323

Malware and tooling: Cloudflared (Cloudflare Tunnel client), QEMU, Velociraptor, Visual Studio Code (code.exe), Zoho Assist

How CVE-2026-28323 works

A critical SAML 2.0 authentication bypass (CVE-2026-28323, CVSS 9.8, CWE-287) lets an unauthenticated network attacker submit a crafted SAML assertion that Web Help Desk accepts as legitimate, granting full impersonation of any federated user without valid credentials. SolarWinds fixed the flaw in Web Help Desk 2026.2.1 (released 2026-07-30); no public PoC or confirmed in-the-wild exploitation exists as of disclosure (2026-07-31).

SolarWinds Web Help Desk (WHD) versions 2026.1 and earlier contain a SAML 2.0 authentication bypass tracked as CVE-2026-28323 (CVSS 3.1 base score 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-287 Improper Authentication). The flaw lies in how WHD validates inbound SAML authentication responses: improper verification of the assertion/signature allows a crafted SAML assertion to be accepted as legitimate, letting a remote, unauthenticated attacker impersonate any user federated through an identity provider such as Okta, Microsoft Entra ID (Azure AD), or Active Directory Federation Services (ADFS) without needing valid credentials. Exploitation requires only that the target deployment have SAML 2.0 SSO enabled and be reachable over the network; no user interaction or prior privileges are required. Successful exploitation grants unauthorized access to help desk tickets, requester/user PII, internal communications, and IT asset inventory data managed inside WHD, and could be used as a foothold into the broader IT environment WHD is trusted to administer.

SolarWinds fixed CVE-2026-28323 in Web Help Desk 2026.2.1, released 2026-07-30, in the same build that also patched CVE-2026-28299 (an unauthenticated memory-exhaustion denial-of-service flaw, CVSS 8.2) and several bundled pgAdmin4 third-party CVEs (remote code execution, command injection, LDAP injection, TLS certificate validation bypass). Version 2026.2.1 also replaces the legacy Tomcat front end with a Caddy-based reverse proxy that enforces TLS 1.2/1.3-only, HTTPS-by-default, and automatic security headers, and restricts internal WHD services to localhost. The vulnerability was responsibly disclosed by security researcher Dhabaleshwar Das and credited by SolarWinds in the 2026.2.1 release notes.

As of this research (2026-07-31), no public proof-of-concept or exploit code for CVE-2026-28323 has been located (including a GitHub/PoC-repository search), SolarWinds' own advisory states no exploitation details or affected request paths have been publicly disclosed, and the CVE does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitability is therefore assessed as THEORETICAL/vendor-confirmed rather than actively weaponized at disclosure time.

That assessment carries real urgency, however, because SolarWinds Web Help Desk has a documented recent history of being weaponized rapidly after disclosure. A distinct, earlier batch of WHD flaws (CVE-2025-40551, CVE-2025-40552, CVE-2025-40553, CVE-2025-40554, CVE-2025-40536, CVE-2025-40537 -- unauthenticated deserialization RCE and authentication bypass in the AjaxProxy/WebObjects components, disclosed 2026-01-28 in WHD 2026.1) was already under active exploitation before public disclosure. Huntress incident-response telemetry places the earliest confirmed post-exploitation persistence artifact -- a QEMU-based SSH-tunnel backdoor registered as a scheduled task named 'TPMProfiler' -- at 2026-01-16 21:24:40 UTC, twelve days before SolarWinds' coordinated disclosure, indicating attackers had working exploit chains in hand ahead of the vendor advisory. CISA added CVE-2025-40551 to its Known Exploited Vulnerabilities catalog on 2026-02-03, triggering a BOD 22-01 remediation deadline of 2026-02-06 for federal civilian agencies, and Microsoft, Elastic Security Labs, and SOC Prime published coordinated technical analyses on 2026-02-06. Huntress independently began investigating a compromised WHD instance on 2026-02-07 and published a detailed intrusion timeline on 2026-02-08, corroborating the same tradecraft: attackers pivoting from an unauthenticated WHD foothold into full domain compromise via living-off-the-land command execution, abuse of legitimate remote-access/forensic tooling (Velociraptor, Cloudflare Tunnel, Zoho ManageEngine, a downloaded Visual Studio Code binary used as a tunneling LOLBin, QEMU-based SSH tunneling), registry-based disabling of endpoint security controls roughly 84 seconds after initial code execution, DLL side-loading for LSASS credential access, DCSync-based credential replication, and NTDS.dit-equivalent credential theft. This related activity is NOT attributed to CVE-2026-28323 and used a different vulnerability chain, but it establishes that internet-exposed, unpatched WHD instances are an active, high-value intrusion target -- reinforcing the priority of patching an unauthenticated, CVSS 9.8 authentication bypass in the same product even absent confirmed exploitation of this specific CVE.

Separately, the WHD denial-of-service flaw bundled into the 2026.2.1 release, CVE-2026-28299 (CVSS 8.2, unauthenticated memory exhaustion), was reserved on 2026-02-26 and its NVD record was published on 2026-06-02 -- well ahead of the 2026.2.1 patch itself. The Canadian Centre for Cyber Security's advisory AV26-549, originally issued 2026-06-04 and updated 2026-06-05, covers CVE-2026-28299 alongside the related Serv-U flaw CVE-2026-28318; it predates and does not reference CVE-2026-28323, which was disclosed separately on 2026-07-30/31.

MITRE ATT&CK techniques used in TL-2026-1789

Credential Access

T1003 OS Credential Dumping; T1606 Forge Web Credentials

Lateral Movement

T1021 Remote Services

Persistence

T1053 Scheduled Task/Job

Execution

T1059 Command and Scripting Interpreter

Discovery

T1069 Permission Groups Discovery; T1087 Account Discovery

Privilege Escalation

T1078 Valid Accounts

Command and Control

T1090 Proxy; T1219 Remote Access Tools

command-and-control

T1105 Ingress Tool Transfer; T1572 Protocol Tunneling

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Defense Evasion

T1197 BITS Jobs; T1574 Hijack Execution Flow

Collection

T1213 Data from Information Repositories

lateral-movement

T1550 Use Alternate Authentication Material

Exfiltration

T1567 Exfiltration Over Web Service

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in CVE-2026-28323

  • SolarWinds — Web Help Desk
    Vulnerable versions: 2026.1; all versions prior to 2026.1 with SAML 2.0 SSO enabled
    Fixed in: 2026.2.1

Remediation for CVE-2026-28323

Patches

  • SolarWinds Web Help Desk 2026.2.1 (released 2026-07-30)

Immediate actions

  • Upgrade all SolarWinds Web Help Desk instances to version 2026.2.1 immediately, prioritizing any deployment that is internet-exposed and/or has SAML 2.0 SSO enabled.
  • If immediate patching is not possible, temporarily disable SAML 2.0 SSO on Web Help Desk and fall back to local authentication, ADFS, or WAFFLE until the patch is applied.
  • Audit Web Help Desk and IdP authentication logs for anomalous SAML assertion replay, unexpected IdP-initiated logins, malformed/duplicate assertion IDs, or logins inconsistent with the identity provider's normal session flow.

Workarounds

  • Disable the SAML 2.0 SSO login path if patching is delayed
  • Restrict Web Help Desk network exposure to internal/VPN-only access until patched

Longer-term hardening

  • Enforce strict SAML assertion signature validation and certificate pinning on both the identity provider and service provider sides of any SSO integration.
  • Place Web Help Desk behind a VPN or zero-trust access proxy instead of exposing it directly to the internet.
  • Enable MFA at the identity provider (Okta, Microsoft Entra ID, ADFS) for all accounts federated into Web Help Desk so a forged assertion alone cannot complete a session.
  • Adopt the WHD 2026.2.1 Caddy-based reverse proxy architecture with its enforced TLS 1.2/1.3-only configuration and default security headers.
  • Given Web Help Desk's recent history as an active intrusion target (Dec 2025 exploitation of a separate CVE batch), monitor for known post-exploitation tradecraft: living-off-the-land execution from the WHD service account, unexpected scheduled tasks, DCSync activity, and outbound tunneling tools.

CVEs associated with CVE-2026-28323

CVE-2026-28323

Weaknesses (CWE) in CVE-2026-28323

CWE-287, CWE-347

Timeline of CVE-2026-28323

  • Threat actors begin exploiting a separate, earlier batch of pre-2026.1 Web Help Desk deserialization/auth-bypass flaws (CVE-2025-40551, CVE-2025-40536, CVE-2025-26399) against internet-exposed instances, per later Microsoft/Elastic reporting (exact date approximate: 'December 2025').
  • Earliest confirmed post-exploitation persistence artifact in the related campaign: a QEMU-based SSH-tunnel backdoor is registered as a scheduled task named 'TPMProfiler' at 21:24:40 UTC, per Huntress incident telemetry -- twelve days before SolarWinds' coordinated disclosure of the related CVE batch.
  • SolarWinds discloses and patches six Web Help Desk vulnerabilities in version 2026.1, including two authentication-bypass flaws (CVE-2025-40552, CVE-2025-40554) and two deserialization RCE flaws (CVE-2025-40551, CVE-2025-40553) distinct from CVE-2026-28323.
  • CISA adds CVE-2025-40551 (Web Help Desk unauthenticated deserialization RCE) to the Known Exploited Vulnerabilities catalog, setting a BOD 22-01 remediation deadline of 2026-02-06 for federal civilian executive branch agencies.
  • Microsoft, Elastic Security Labs, and SOC Prime publish coordinated analysis of active in-the-wild exploitation of the pre-2026.1 Web Help Desk flaws, detailing post-exploitation tradecraft (Velociraptor, QEMU tunneling, DCSync, DLL side-loading).
  • A Huntress SOC analyst begins investigating an independently observed compromised Web Help Desk instance tied to the related exploitation wave.
  • Huntress publishes a detailed intrusion timeline corroborating the Velociraptor/Cloudflared/QEMU/DCSync tradecraft, including a downloaded Visual Studio Code binary abused as a tunneling LOLBin and registry-based security-control tampering roughly 84 seconds after initial code execution.
  • CVE-2026-28299 (Web Help Desk unauthenticated memory-exhaustion denial-of-service, CVSS 8.2) is reserved -- later bundled into the 2026.2.1 fix alongside CVE-2026-28323.
  • NVD publishes the CVE-2026-28299 record.
  • The Canadian Centre for Cyber Security issues advisory AV26-549 covering CVE-2026-28299 and the related Serv-U flaw CVE-2026-28318; the advisory predates and does not reference CVE-2026-28323.
  • SolarWinds releases Web Help Desk 2026.2.1, fixing CVE-2026-28323 (SAML authentication bypass, CVSS 9.8) and CVE-2026-28299 (denial-of-service, CVSS 8.2), and migrating the product to a Caddy-based reverse proxy with enforced TLS 1.2/1.3.
  • NVD publishes the CVE-2026-28323 record with CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 9.8) and CWE-287 (Improper Authentication) classification.
  • As of research, no public proof-of-concept exploit or confirmed in-the-wild exploitation of CVE-2026-28323 has been identified, and the CVE is absent from the CISA Known Exploited Vulnerabilities catalog.
  • Cyber Security News and follow-on outlets (GBHackers) publish coverage of CVE-2026-28323, crediting security researcher Dhabaleshwar Das for responsible disclosure.

Sources cited for CVE-2026-28323

Detection coverage for TL-2026-1789

As of 2026-07-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1789 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
23 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats