SolarWinds has released a patch for a critical vulnerability in its Web Help Desk platform that could allow attackers to walk past SAML-based single sign-on entirely — no valid credentials required. Tracked as CVE-2026-28323, the flaw carries a maximum-severity CVSS score of 9.8 and affects any Web Help Desk deployment using SAML 2.0 for authentication.

What Went Wrong

SAML, short for Security Assertion Markup Language, is the protocol many organizations use to connect internal applications to a centralized identity provider such as Microsoft Entra ID, Okta, or Active Directory Federation Services. It’s what allows employees to log in once and gain access to multiple connected business tools without re-entering credentials each time.

CVE-2026-28323 is classified as a SAML authentication bypass. In practice, that means the flaw could let an attacker skip the expected login handshake with the identity provider altogether and gain access to a vulnerable Web Help Desk instance as if they had authenticated normally. Security researcher Dhabaleshwar Das is credited with responsibly disclosing the issue to SolarWinds.

Why an Authentication Bypass Is Especially Dangerous

Unlike a bug that requires a specific set of conditions or elevated privileges to exploit, an authentication bypass defeats the access-control boundary itself. Depending on the account context and permissions tied to the exposed session, a successful exploit could expose:

• Help desk tickets and their contents
• Internal user information and communications
• IT asset inventories and other operational data

Help desk portals are a particularly attractive target because they are typically reachable by a wide mix of employees, contractors, and sometimes external users — making them a convenient entry point for attackers looking for initial access or sensitive internal information without needing to phish anyone first.

SolarWinds has not publicly disclosed the technical exploitation details, the specific request paths involved, or any evidence that the flaw has been exploited in the wild. Given the critical severity rating and the sensitive role these portals play inside enterprise environments, however, security teams are being advised to treat the update as urgent regardless of confirmed exploitation.

The Fix and What Else It Includes

The vulnerability is resolved in Web Help Desk version 2026.2.1, released July 30, 2026. The update is not a narrow patch — it bundles several other security-relevant changes:

• A fix for CVE-2026-28299, a high-severity (CVSS 8.2) denial-of-service flaw caused by insufficient memory handling
• Patches for multiple third-party pgAdmin vulnerabilities, including remote code execution, command injection, LDAP injection, and TLS certificate validation bypass
• A redesigned interface built on a new Caddy-based front-end architecture
• Support restricted to TLS 1.2/1.3, enforced HTTPS, added security headers, and server version details stripped from responses

Notably, the release also drops support for servlet authentication. Organizations still relying on that method will need to migrate to either SAML 2.0 or HTTP Header authentication as part of the upgrade.

What Administrators Should Do Now

SolarWinds recommends upgrading to version 2026.2.1 as soon as possible, particularly for any deployment with SAML SSO enabled. Organizations running versions older than 2026.1 need to upgrade to 2026.1 first, confirm normal operation, and only then proceed to 2026.2.1 — skipping this staged path is not supported.

After upgrading, administrators should:

• Test SAML authentication end-to-end with their identity provider
• Review Web Help Desk access logs for unusual login activity or unexpected sessions predating the patch
• Confirm any servlet-authentication users have been migrated to a supported method

Given that help desk software often sits at the intersection of IT operations and sensitive internal data, this is one of those patches worth prioritizing over the next routine maintenance cycle rather than deferring to it.

Context: Help Desk Software as a Recurring Target

This is not the first time help desk and IT service management platforms have drawn attention from attackers. These tools sit in a privileged position, often holding credentials, asset inventories, and internal ticket histories that can accelerate a broader intrusion once accessed. A critical, unauthenticated bypass in a widely deployed platform like Web Help Desk is the kind of flaw that tends to attract scanning activity quickly once details become public, even without a proof-of-concept being formally released. Patching promptly, rather than waiting for confirmed in-the-wild exploitation, remains the more defensible position for any organization running SAML-based SSO on this platform.