Summary
On July 30th, 2026, SolarWinds released fixes for a critical Authentication-Bypass vulnerability in Web Help Desk (WHD) tracked as CVE-2026-28323, and a related high-severity Denial-of-Service vulnerability, tracked as CVE-2026-28299. Although no active exploitation has been observed yet, WHD is commonly internet-facing and the authentication bypass requires no credentials, making it a likely target once exploit code becomes available.
CVE-2026-28323 affects WHD when SAML 2.0 authentication is enabled. A remote unauthenticated attacker may craft or relay a malicious SAMLResponse to the SAML Assertion Consumer Service endpoint and establish a session without valid credentials. CVE-2026-28299 can be triggered through unauthenticated interaction with a WHD endpoint, potentially causing resource exhaustion and service crashes. SolarWinds has addressed both CVE-2026-28323 and CVE-2026-28299 in WHD 2026.2.1.
Recommendations for CVE-2026-28323 and CVE-2026-28299
Immediate Action
- Upgrading to WHD 2026.2.1 or later fixes both CVE-2026-28323 and CVE-2026-28299.
Temporary Workaround
- If immediate patching is not possible, disable Security Assertion Markup Language (SAML) 2.0 in SolarWinds Web Help Desk (WHD), and use local or Lightweight Directory Access Protocol (LDAP) / Active Directory (AD) authentication, with multi-factor authentication (MFA) enforced via a virtual private network (VPN) or zero trust network access (ZTNA).
Authentication Hardening
- Use SAML 2.0 (AD FS) or CAS to delegate authentication to an identity provider that enforces MFA.
- Apply a web application firewall (WAF) or reverse-proxy controls for SAML endpoints, including Hypertext Transfer Protocol (HTTP) method allowlists, identity provider (IdP)referrer/origin enforcement, assertion-size and request-body limits, and SAMLResponse parameter limits.
- Ensure your IdP requires strong second factors (e.g., TOTP, hardware tokens).
- Where IdP integration is not feasible, require remote access via VPN or ZTNA that enforces MFA at the perimeter.
Reduce Exposure
- Remove public internet exposure where possible. Require VPN or ZTNA access and limit access to trusted IP ranges.
- Apply Principle of Least Privilege: restrict admin accounts to dedicated privileged sessions and disable default vendor accounts