Full Report
Multiple vulnerabilities have been discovered in SolarWinds Web Help Desk, the most severe of which could allow for authentication bypass. SolarWinds Web Help Desk software grants access to SolarWinds IT support, asset management, and knowledge base operations. A vulnerability in the Web Help Desk could allow an unauthenticated, remote attacker to bypass authentication and gain access. This does require the SAML 2.0 authentication method to be enabled.
Analysis Summary
# Vulnerability: SolarWinds Web Help Desk SAML Authentication Bypass
## CVE Details
- **CVE ID:** CVE-2026-28323 (Primary), CVE-2026-28299 (Secondary)
- **CVSS Score:** Not explicitly listed (Assessed as HIGH/Critical based on "Authentication Bypass" impact)
- **CWE:** Not specified (Related to Improper Authentication / SAML Validation)
## Affected Systems
- **Products:** SolarWinds Web Help Desk (WHD)
- **Versions:** All versions prior to 2026.2.1
- **Configurations:** Systems where **SAML 2.0 authentication** is enabled.
## Vulnerability Description
The primary flaw (CVE-2026-28323) is a SAML authentication bypass vulnerability. If SAML 2.0 is configured as the authentication method, an unauthenticated remote attacker can bypass security checkpoints to gain unauthorized access to the Web Help Desk instance.
Additionally, CVE-2026-28299 identifies a Denial-of-Service (DoS) vulnerability where the server can be forced into an out-of-memory state, leading to a system crash.
## Exploitation
- **Status:** Not currently reported as exploited in the wild.
- **Complexity:** Low (Targeting public-facing SAML endpoints).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Full access to IT support tickets, asset management data, and knowledge bases).
- **Integrity:** High (Ability to modify assets and support records).
- **Availability:** High (Potential for system crash via DoS vulnerability).
## Remediation
### Patches
- **SolarWinds Web Help Desk 2026.2.1:** This version contains fixes for both the SAML bypass and the DoS vulnerability.
### Workarounds
- **Disable SAML 2.0:** If patching is not immediately possible, disabling SAML 2.0 authentication and reverting to local authentication will mitigate the risk of CVE-2026-28323.
- **Network Segmentation:** Limit access to the Web Help Desk interface to internal VPN users only to reduce the attack surface.
## Detection
- **Indicators of Compromise:** Monitor logs for successful logins from unexpected IP addresses that do not correspond with SAML provider logs.
- **Detection methods and tools:**
- Perform automated vulnerability scans using SCAP-compliant tools.
- Conduct authenticated penetration testing to verify if the SAML flow can be manipulated.
- Review application memory usage for spikes indicating DoS attempts.
## References
- SolarWinds Release Notes: hxxps[://]documentation[.]solarwinds[.]com/en/success_center/whd/content/release_notes/whd_2026-2-1_release_notes[.]htm
- CVE-2026-28323: hxxps[://]cve[.]mitre[.]org/cgi-bin/cvename[.]cgi?name=CVE-2026-28323
- CVE-2026-28299: hxxps[://]cve[.]mitre[.]org/cgi-bin/cvename[.]cgi?name=CVE-2026-28299