NCSC-2026-0274 [1.00] [M/H] Vulnerability patched in SolarWinds Web Help Desk
SolarWinds has patched a vulnerability in SolarWinds Web Help Desk. The vulnerability concerns an authentication bypass in the SAML 2.0 authentication of SolarWinds Web Help Desk. This vulnerability occurs in systems where SAML authentication is enabled. An attacker can bypass authentication by exploiting the manner in which SAML assertions are processed, thereby gaining unauthorized access to the system. This affects the integrity of the authentication mechanism and can lead to access to sensitive administrative functions.
CSIRTS triage
- What
- SAML 2.0 authentication bypass in SolarWinds Web Help Desk exploits improper SAML assertion processing to gain unauthorized access and administrative function control.
- Who is affected
- Systems with SAML authentication enabled in SolarWinds Web Help Desk are affected.
- Urgency
- Critical urgency; SAML authentication bypass compromises the integrity of authentication and provides direct access to sensitive administrative functions.
- Action
- Apply the SolarWinds Web Help Desk security patch addressing SAML assertion validation.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Web Help Desk
Get an email when a new Web Help Desk advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0274
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-283230.64% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 47% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-28323 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
Recent advisories for SolarWinds Web Help
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[UPDATE] [high] SolarWinds Web Help Desk: Vulnerability enables bypass of security measurescert-bund · 2026-08-03
- criticalCVE-2026-28323: SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability…nvd · 2026-07-30
- criticalexploitedCVE-2025-26399: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerabilitycisa-kev · 2026-03-09
- criticalexploitedCVE-2025-40536: SolarWinds Web Help Desk Security Control Bypass Vulnerabilitycisa-kev · 2026-02-12
- criticalexploitedCVE-2025-40551: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerabilitycisa-kev · 2026-02-03
- criticalexploitedCVE-2024-28987: SolarWinds Web Help Desk Hardcoded Credential Vulnerabilitycisa-kev · 2024-10-15
More from NCSC-NL Advisories
- unknownNCSC-2026-0275 [1.01] [M/H] Vulnerabilities patched in N-able N-central2026-08-07
- unknownNCSC-2026-0278 [1.00] [M/H] Vulnerabilities patched in Adobe Campaign Classic2026-08-06
- unknownNCSC-2026-0277 [1.00] [M/H] Vulnerabilities patched in Cisco Catalyst SD-WAN2026-08-06
- unknownNCSC-2026-0276 [1.00] [M/H] Vulnerabilities patched in Veeam Service Provider Console2026-08-05
- unknownNCSC-2026-0268 [1.01] [M/H] Vulnerability patched in SQLite by SQLite Consortium (withdrawn)2026-08-03