Is CVE-2026-28323 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28323 being exploited in the wild.

How severe is CVE-2026-28323?

Critical severity, with a CVSS score of 9.8, published 30 July 2026.

Which products and versions are affected?

SolarWinds Web Help Desk 2026.1 and all previous versions.

Is there a fix for CVE-2026-28323?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-28323 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-28323?

Check whether you run SolarWinds Web Help Desk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28323: SolarWinds Web Help Desk SAML authentication bypass

CVE-2026-28323 · Severity: critical · CVSS 9.8 · Published 2026-07-30

SolarWinds Web Help Desk, a software platform used for managing IT service requests and support tickets, is vulnerable to a critical security flaw that allows attackers to bypass login requirements. If the system is configured to use SAML 2.0 for single sign-on, an unauthorized user could gain full access to the help desk environment. This could lead to the exposure of sensitive support data, unauthorized modification of records, or complete disruption of help desk operations.

Technologies: SolarWinds Web Help Desk. Vendors: SolarWinds.

Quick answers

Is CVE-2026-28323 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28323 being exploited in the wild.
How severe is CVE-2026-28323?: Critical severity, with a CVSS score of 9.8, published 30 July 2026.
Which products and versions are affected?: SolarWinds Web Help Desk 2026.1 and all previous versions.
Is there a fix for CVE-2026-28323?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-28323 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-28323?: Check whether you run SolarWinds Web Help Desk at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A critical authentication bypass vulnerability (CWE-287) exists in SolarWinds Web Help Desk when configured with SAML 2.0 authentication. The flaw allows a remote, unauthenticated attacker to bypass the authentication process and gain unauthorized access to the application. The vulnerability is exploitable over the network with low complexity and requires no user interaction. SolarWinds has addressed this issue in Web Help Desk version 2026.2.1. Organizations using version 2026.1 or earlier with SAML enabled should upgrade immediately.

Affected products

SolarWinds Web Help Desk 2026.1 and all previous versions

Timeline

2026-07-23: disclosed: First published by SolarWinds
2026-07-30: advisory: NVD advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.