6 mincritical
CVE-2026-28323 and CVE-2026-28299 | Arctic Wolf
SolarWinds Web Help Desk (WHD) is affected by a critical unauthenticated authentication bypass (CVE-2026-28323) and a related high-severity Denial-of-Service flaw (CVE-2026-28299). The authentication bypass targets the SAML 2.0 Assertion Consumer Service endpoint, allowing session establishment without credentials. Both issues are resolved in WHD 2026.2.1; no active exploitation has been observed at the time of publication.
Sens:■ ImmediateConf:high
Showing defanged values
- cveCVE-2026-28299Unauthenticated interaction with a WHD endpoint can cause resource exhaustion and service crashes.
- cveCVE-2026-28323Unauthenticated remote attacker can craft or relay a malicious SAMLResponse to the SAML Assertion Consumer Service endpoint to establish a session without valid credentials.
Detection / Hunteropenrouter
What Happened
SolarWinds released fixes for two security flaws in its Web Help Desk product. The first flaw lets an attacker log in without a password by sending a specially crafted login message when SAML single sign-on is turned on. The second flaw lets an attacker crash the service by sending certain unauthenticated requests. Anyone running an unpatched version of Web Help Desk exposed to the internet is at risk. Organizations should update to version 2026.2.1 or later immediately, or disable SAML and restrict access to the service as a temporary measure.
Key Takeaways
- CVE-2026-28323 is a critical unauthenticated authentication bypass in SolarWinds Web Help Desk (WHD) when SAML 2.0 is enabled, allowing session establishment via a crafted SAMLResponse.
- CVE-2026-28299 is a related high-severity unauthenticated Denial-of-Service vulnerability in WHD causing resource exhaustion and service crashes.
- Both vulnerabilities are fixed in WHD version 2026.2.1.
- No active exploitation has been observed, but WHD is commonly internet-facing and exploitability is likely once public exploit code emerges.
- Temporary workaround requires disabling SAML 2.0 and falling back to LDAP/AD with MFA enforced via VPN or ZTNA.
Affected Systems
- SolarWinds Web Help Desk (WHD) versions prior to 2026.2.1 with SAML 2.0 authentication enabled
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-28323 | SolarWinds Web Help Desk (WHD) | Critical | Unauthenticated remote attacker can craft or relay a malicious SAMLResponse to the SAML Assertion Consumer Service endpoint to establish a session without valid credentials. |
| CVE-2026-28299 | SolarWinds Web Help Desk (WHD) | High | Unauthenticated interaction with a WHD endpoint can cause resource exhaustion and service crashes. |
Attack Chain
- Reconnaissance: Attacker identifies an internet-facing SolarWinds Web Help Desk instance with SAML 2.0 enabled.
- Initial Access: Attacker crafts or relays a malicious SAMLResponse to the SAML Assertion Consumer Service endpoint to bypass authentication (CVE-2026-28323).
- Session Establishment: Attacker obtains a valid session without credentials.
- Impact: Attacker interacts with WHD functionality; alternatively, unauthenticated requests trigger resource exhaustion and service crash (CVE-2026-28299).
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide detection rules or queries. It recommends WAF or reverse-proxy controls including HTTP method allowlists, IdP referrer/origin enforcement, assertion-size and request-body limits, and SAMLResponse parameter limits as preventative measures.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The vulnerability is exploited via unauthenticated HTTP requests to a web application. EDR on the WHD host may see process crashes for CVE-2026-28299 but has limited visibility into the authentication bypass itself. |
| Network Visibility | Medium | Network inspection of HTTP(S) traffic to the WHD SAML Assertion Consumer Service endpoint could reveal anomalous SAMLResponse payloads, but TLS encryption limits visibility unless the traffic is inspected at a reverse proxy or WAF. |
| Detection Difficulty | Hard | Detecting a crafted SAMLResponse requires application-layer inspection of SAML assertions, which is not available in standard log sources without specialized WAF rules or custom application logging. |
Required Log Sources
- Web Help Desk application logs
- Reverse proxy / WAF logs
- SAML IdP logs
- Network flow logs to WHD
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for unauthenticated sessions established on WHD shortly after anomalous SAMLResponse submissions to the Assertion Consumer Service endpoint. | WHD application logs, reverse proxy access logs, WAF logs | Initial Access | Medium — legitimate SAML SSO logins will appear similar; correlation with IdP logs is needed to identify sessions lacking a corresponding IdP authentication event. |
| Consider hunting for repeated unauthenticated requests to WHD endpoints followed by service process restarts or crashes, which may indicate CVE-2026-28299 exploitation. | EDR process telemetry, WHD service logs, uptime monitoring | Impact | Low to Medium — service crashes can have other causes, but correlation with unauthenticated request spikes increases confidence. |
| Consider hunting for WHD sessions established without a corresponding authentication event in the configured SAML IdP. | WHD session logs correlated with IdP authentication logs | Initial Access | Low — a session in WHD with no matching IdP login is a strong indicator of bypass. |
Control Gaps
- Standard EDR will not inspect SAML assertion contents at the application layer.
- TLS-encrypted traffic to WHD may bypass network-based detection unless terminated at a WAF or reverse proxy.
- Without IdP log correlation, forged session establishment may appear as a legitimate login.
Key Behavioral Indicators
- WHD session creation events lacking a corresponding SAML IdP authentication event within a reasonable time window.
- Spike in unauthenticated HTTP requests to WHD endpoints preceding service process termination or restart.
- Anomalously large SAMLResponse parameters or unexpected HTTP methods submitted to the SAML Assertion Consumer Service endpoint.
False Positive Assessment
Low — detection relies on correlating WHD sessions with IdP authentication events; a session without a matching IdP event is a strong indicator of exploitation.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider upgrading SolarWinds Web Help Desk to version 2026.2.1 or later immediately to remediate both CVE-2026-28323 and CVE-2026-28299.
- If immediate patching is not possible, consider disabling SAML 2.0 in WHD and falling back to local or LDAP/AD authentication with MFA enforced via VPN or ZTNA.
- Evaluate whether public internet exposure of WHD can be removed entirely, restricting access to trusted IP ranges or requiring VPN/ZTNA.
Infrastructure Hardening
- Consider deploying a WAF or reverse proxy in front of WHD SAML endpoints with HTTP method allowlists, IdP referrer/origin enforcement, assertion-size and request-body limits, and SAMLResponse parameter limits.
- Where feasible, delegate authentication to an IdP enforcing MFA (e.g., AD FS or CAS).
- Consider applying the Principle of Least Privilege by restricting admin accounts to dedicated privileged sessions and disabling default vendor accounts.
User Protection
- If your IdP supports it, ensure strong second factors (e.g., TOTP, hardware tokens) are required for WHD access.
- Where IdP integration is not feasible, consider requiring remote access via VPN or ZTNA that enforces MFA at the perimeter.
Security Awareness
- Consider notifying IT service desk staff to report any unexpected WHD session prompts or service disruptions.
- If applicable, roll guidance on recognizing anomalous SSO behavior into existing security awareness programs.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping2 techniques
Tactic
Initial Access
Tactic
