SolarWinds has addressed a critical security vulnerability in its Web Help Desk software that could allow attackers to bypass SAML-based authentication mechanisms. This flaw, identified as CVE-2026-28323, affects deployments utilizing SAML 2.0 single sign-on (SSO) and has been resolved in version 2026.2.1, released on July 30, 2026.
The vulnerability carries a CVSS severity score of 9.8, underscoring its critical nature. Security researcher Dhabaleshwar Das is credited with responsibly reporting the issue. CVE-2026-28323 is classified as a SAML authentication bypass vulnerability.
Understanding SAML and Its Role in Authentication
Security Assertion Markup Language (SAML) is a widely adopted protocol that enables organizations to implement single sign-on (SSO) capabilities. By connecting applications with centralized identity providers such as Microsoft Entra ID, Okta, and Active Directory Federation Services (ADFS), SAML allows users to authenticate once and gain access to multiple connected applications seamlessly.
An authentication bypass within this process is particularly concerning, as it can undermine a fundamental access control mechanism. Exploiting this vulnerability could grant unauthorized access to a Web Help Desk instance without completing the standard SAML login process.
Potential Impact of the Vulnerability
Depending on the permissions associated with the compromised account, unauthorized access could expose sensitive information, including help desk tickets, user data, internal communications, IT asset details, and other operational data managed through the platform.
SolarWinds has not publicly disclosed specific technical details regarding the exploitation of this vulnerability, the affected request paths, or any evidence of active exploitation. However, given the critical severity and the sensitive role that help desk platforms play in enterprise environments, organizations are urged to treat this issue with urgency.
Help desk portals are typically accessible to employees, contractors, and external users, making them attractive targets for attackers seeking initial access or sensitive internal data.
Additional Security Fixes in Version 2026.2.1
While the vulnerability specifically affects deployments using SAML 2.0 authentication, all administrators are advised to apply the update, as it includes multiple security fixes. Web Help Desk version 2026.2.1 also addresses CVE-2026-28299, a high-severity denial-of-service flaw with a CVSS score of 8.2. This vulnerability could allow an attacker to crash a Web Help Desk server due to insufficient memory handling.
Additionally, the update incorporates fixes for multiple third-party vulnerabilities, including remote code execution, command injection, LDAP injection, and TLS certificate validation bypass issues. The latest release introduces a redesigned interface and a new Caddy-based front-end architecture.
SolarWinds now supports only TLS 1.2/1.3, enforces HTTPS, applies security headers, restricts internal services to local access, and removes server version details from responses.
Recommendations for Administrators
Administrators should upgrade to Web Help Desk version 2026.2.1 as soon as possible, particularly if SAML SSO is enabled. Organizations upgrading from earlier versions than 2026.1 must first upgrade to 2026.1, verify normal operation, and then proceed to 2026.2.1.
Teams should test SAML authentication with their identity provider after the upgrade and review Web Help Desk access logs for unusual login activity or unexpected account sessions.
SolarWinds also noted that servlet authentication is no longer supported in Web Help Desk version 2026.2.1. Customers relying on that method should plan a migration to either SAML 2.0 or HTTP Header authentication, ensuring that the newly deployed SSO configuration is fully tested and protected by the latest patch.
This incident highlights the critical importance of promptly addressing vulnerabilities in authentication mechanisms, especially in systems that manage sensitive organizational data. Organizations should prioritize regular security assessments and timely application of patches to mitigate potential risks.
