# CVE-2026-28323: SolarWinds Web Help Desk SAML Authentication Bypass

> A critical SAML 2.0 authentication bypass (CVE-2026-28323, CVSS 9.8, CWE-287) lets an unauthenticated network attacker submit a crafted SAML assertion that Web Help Desk accepts as legitimate, granting full impersonation of any federated user without valid credentials. SolarWinds fixed the flaw in Web Help Desk 2026.2.1 (released 2026-07-30); no public PoC or confirmed in-the-wild exploitation exists as of disclosure (2026-07-31).

- **Published:** 2026-07-31T00:00:00Z
- **Last reviewed:** 2026-07-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1789
- **ID:** TL-2026-1789
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-28323

## Description

SolarWinds Web Help Desk (WHD) versions 2026.1 and earlier contain a SAML 2.0 authentication bypass tracked as CVE-2026-28323 (CVSS 3.1 base score 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-287 Improper Authentication). The flaw lies in how WHD validates inbound SAML authentication responses: improper verification of the assertion/signature allows a crafted SAML assertion to be accepted as legitimate, letting a remote, unauthenticated attacker impersonate any user federated through an identity provider such as Okta, Microsoft Entra ID (Azure AD), or Active Directory Federation Services (ADFS) without needing valid credentials. Exploitation requires only that the target deployment have SAML 2.0 SSO enabled and be reachable over the network; no user interaction or prior privileges are required. Successful exploitation grants unauthorized access to help desk tickets, requester/user PII, internal communications, and IT asset inventory data managed inside WHD, and could be used as a foothold into the broader IT environment WHD is trusted to administer.

SolarWinds fixed CVE-2026-28323 in Web Help Desk 2026.2.1, released 2026-07-30, in the same build that also patched CVE-2026-28299 (an unauthenticated memory-exhaustion denial-of-service flaw, CVSS 8.2) and several bundled pgAdmin4 third-party CVEs (remote code execution, command injection, LDAP injection, TLS certificate validation bypass). Version 2026.2.1 also replaces the legacy Tomcat front end with a Caddy-based reverse proxy that enforces TLS 1.2/1.3-only, HTTPS-by-default, and automatic security headers, and restricts internal WHD services to localhost. The vulnerability was responsibly disclosed by security researcher Dhabaleshwar Das and credited by SolarWinds in the 2026.2.1 release notes.

As of this research (2026-07-31), no public proof-of-concept or exploit code for CVE-2026-28323 has been located (including a GitHub/PoC-repository search), SolarWinds' own advisory states no exploitation details or affected request paths have been publicly disclosed, and the CVE does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitability is therefore assessed as THEORETICAL/vendor-confirmed rather than actively weaponized at disclosure time.

That assessment carries real urgency, however, because SolarWinds Web Help Desk has a documented recent history of being weaponized rapidly after disclosure. A distinct, earlier batch of WHD flaws (CVE-2025-40551, CVE-2025-40552, CVE-2025-40553, CVE-2025-40554, CVE-2025-40536, CVE-2025-40537 -- unauthenticated deserialization RCE and authentication bypass in the AjaxProxy/WebObjects components, disclosed 2026-01-28 in WHD 2026.1) was already under active exploitation before public disclosure. Huntress incident-response telemetry places the earliest confirmed post-exploitation persistence artifact -- a QEMU-based SSH-tunnel backdoor registered as a scheduled task named 'TPMProfiler' -- at 2026-01-16 21:24:40 UTC, twelve days before SolarWinds' coordinated disclosure, indicating attackers had working exploit chains in hand ahead of the vendor advisory. CISA added CVE-2025-40551 to its Known Exploited Vulnerabilities catalog on 2026-02-03, triggering a BOD 22-01 remediation deadline of 2026-02-06 for federal civilian agencies, and Microsoft, Elastic Security Labs, and SOC Prime published coordinated technical analyses on 2026-02-06. Huntress independently began investigating a compromised WHD instance on 2026-02-07 and published a detailed intrusion timeline on 2026-02-08, corroborating the same tradecraft: attackers pivoting from an unauthenticated WHD foothold into full domain compromise via living-off-the-land command execution, abuse of legitimate remote-access/forensic tooling (Velociraptor, Cloudflare Tunnel, Zoho ManageEngine, a downloaded Visual Studio Code binary used as a tunneling LOLBin, QEMU-based SSH tunneling), registry-based disabling of endpoint security controls roughly 84 seconds after initial code execution, DLL side-loading for LSASS credential access, DCSync-based credential replication, and NTDS.dit-equivalent credential theft. This related activity is NOT attributed to CVE-2026-28323 and used a different vulnerability chain, but it establishes that internet-exposed, unpatched WHD instances are an active, high-value intrusion target -- reinforcing the priority of patching an unauthenticated, CVSS 9.8 authentication bypass in the same product even absent confirmed exploitation of this specific CVE.

Separately, the WHD denial-of-service flaw bundled into the 2026.2.1 release, CVE-2026-28299 (CVSS 8.2, unauthenticated memory exhaustion), was reserved on 2026-02-26 and its NVD record was published on 2026-06-02 -- well ahead of the 2026.2.1 patch itself. The Canadian Centre for Cyber Security's advisory AV26-549, originally issued 2026-06-04 and updated 2026-06-05, covers CVE-2026-28299 alongside the related Serv-U flaw CVE-2026-28318; it predates and does not reference CVE-2026-28323, which was disclosed separately on 2026-07-30/31.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1606 Forge Web Credentials
- T1550 Use Alternate Authentication Material
- T1078 Valid Accounts
- T1213 Data from Information Repositories
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1574 Hijack Execution Flow
- T1685 Disable or Modify Tools
- T1105 Ingress Tool Transfer
- T1197 BITS Jobs
- T1003 OS Credential Dumping
- T1069 Permission Groups Discovery
- T1087 Account Discovery
- T1021 Remote Services
- T1572 Protocol Tunneling
- T1090 Proxy
- T1219 Remote Access Tools
- T1567 Exfiltration Over Web Service

## Sources

- [SolarWinds Flaw Let Attackers Bypass Web Help Desk SAML Login](https://cybersecuritynews.com/solarwinds-flaw-bypass-web-help-desk-saml-login/)
- [Critical SolarWinds Web Help Desk Flaw Lets Attackers Bypass SAML Authentication](https://gbhackers.com/critical-solarwinds-web-help-desk-flaw/)
- [CVE-2026-28323 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-28323)
- [SolarWinds Security Advisory - CVE-2026-28323](https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28323)
- [Web Help Desk 2026.2.1 Release Notes](https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-2-1_release_notes.htm)
- [Web Help Desk Secure Configuration Guide](https://documentation.solarwinds.com/en/success_center/whd/content/helpdesksecureconfiguration.htm)
- [SolarWinds security advisory (AV26-549) - Update 1 covers CVE-2026-28299 / CVE-2026-28318, not CVE-2026-28323](https://www.cyber.gc.ca/en/alerts-advisories/solarwinds-security-advisory-av26-549)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2026-28323 not listed as of research date)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [SolarWinds Fixes Four Critical Web Help Desk Flaws With Unauthenticated RCE and Auth Bypass](https://thehackernews.com/2026/01/solarwinds-fixes-four-critical-web-help.html)
- [Multiple Critical Authentication Bypass and Remote Code Execution Vulnerabilities Fixed in SolarWinds Web Help Desk](https://arcticwolf.com/resources/blog/multiple-critical-authentication-bypass-remote-code-execution-vulnerabilities-fixed-in-solarwinds-web-help-desk/)
- [SolarWinds Web Help Desk Vulnerabilities Update](https://www.cycognito.com/blog/solarwinds-web-help-desk-vulnerabilities-update/)
- [CISA Adds Four Known Exploited Vulnerabilities to Catalog (includes CVE-2025-40551)](https://www.cisa.gov/news-events/alerts/2026/02/03/cisa-adds-four-known-exploited-vulnerabilities-catalog)
- [CISA Adds Actively Exploited SolarWinds Web Help Desk RCE to KEV Catalog](https://thehackernews.com/2026/02/cisa-adds-actively-exploited-solarwinds.html)
- [SolarWinds Web Help Desk Exploitation - February 2026](https://www.elastic.co/security-labs/solarwinds-whd-exploitation)
- [Analysis of active exploitation of SolarWinds Web Help Desk](https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1789