Attack Chain

1. Attacker performs reconnaissance to identify internet-facing SolarWinds Web Help Desk instances.
2. Attacker probes the application to confirm if SAML 2.0 authentication is enabled.
3. Attacker crafts a malicious or crafted SAML assertion or bypass request targeting the WHD authentication endpoint.
4. The application improperly validates the SAML response or authentication state, granting the attacker an authenticated session.
5. Attacker gains unauthorized access to the Web Help Desk administrative or user interface.
6. Attacker leverages this access to perform internal actions, potentially including data exfiltration or system modification depending on the privileges of the hijacked session.

Impact

Successful exploitation allows an unauthenticated attacker to gain unauthorized access to the SolarWinds Web Help Desk instance. This may lead to the exposure of sensitive help desk tickets, internal user information, and potential administrative control over the help desk infrastructure. The vulnerability affects all organizations utilizing WHD with SAML 2.0 enabled, creating a significant risk of data breach and unauthorized system manipulation.

Recommendation

• Upgrade to SolarWinds Web Help Desk version 2026.2.1 or later to remediate CVE-2026-28323.
• Audit web server and application access logs for unusual patterns of authentication attempts directed at the SAML callback or login endpoints.
• Monitor for anomalous administrative activities occurring from unexpected user sessions or source IP addresses within the help desk application.
• Review the SolarWinds security advisory for CVE-2026-28323 and follow recommended hardening steps for Web Help Desk configurations.