# CVE-2026-111283: BMC Helix Network Management authentication bypass in SAML

Source: https://junglewise.ai/threats/cve-2026-111283-bmc-helix-network-management-on-prem-before-26-3-01-contains-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-111283 · Severity: critical · CVSS 9 · Published 2026-10-15

BMC Helix Network Management is an on-premises network monitoring and management platform. When SAML single sign-on is enabled, an unauthenticated attacker can log in as the local administrator with any password, gaining full control to modify device credentials, execute device commands, and tamper with audit logs.

Vendors: [Bmc](https://junglewise.ai/threats/vendors/bmc).

## Quick answers

**Is CVE-2026-111283 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111283 being exploited in the wild.

**How severe is CVE-2026-111283?** Critical severity, with a CVSS score of 9, published 15 October 2026.

**Which products and versions are affected?** Bmc Helix Network Management before 26.3.01.

**Is there a fix for CVE-2026-111283?** Yes: fixed in 26.3.01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111283 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-111283?** Check whether you run Bmc Helix Network Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 26.3.01

## Technical details

An authentication bypass vulnerability exists in BMC Helix Network Management on-prem versions before 26.3.01 where SAML single sign-on is configured. An unauthenticated attacker can submit the administrator username with an arbitrary password via the web login page to obtain a SuperAdmin session. The vulnerability stems from improper password validation when SAML is enabled, allowing complete bypass of authentication controls.

## Affected products

- BMC Helix Network Management before 26.3.01

## Timeline

- 2026-10-15: disclosed
- 2026-08-24: patched: Fix released in version 26.3.01

## References

- [https://docs.helixops.ai/bin/IT-Operations-Management/Operations-Management/BMC-Helix-Network-Management/NetworkManagement/Release-Notes/On-prem-Release-Notes/BMC-Helix-Network-Management-26-3-01-On-prem-Release-Notes/](https://docs.helixops.ai/bin/IT-Operations-Management/Operations-Management/BMC-Helix-Network-Management/NetworkManagement/Release-Notes/On-prem-Release-Notes/BMC-Helix-Network-Management-26-3-01-On-prem-Release-Notes/)
- [https://www.vulncheck.com/advisories/bmc-helix-network-management-before-26.3.01-authentication-bypass-via-saml-configuration](https://www.vulncheck.com/advisories/bmc-helix-network-management-before-26.3.01-authentication-bypass-via-saml-configuration)