From Token Bingo to MAX Takeover: Kali365 Operator Expands Operation Across Microsoft Outlook, Okta, Xerox DocuShare, and Other Services
Mentions the CVE; no further detail.
CVE-2026-28323 Critical · 9.8 EPSS 1.0%
SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability
SolarWinds · Web Help Desk
Summary
SolarWinds Web Help Desk contains a SAML authentication bypass flaw in its SAML 2.0 authentication handling, which is only present when that authentication method is enabled. An attacker with network access, requiring no privileges and no user interaction, can bypass authentication through the SAML flow to gain unauthorised access to the application.
Official description · CVE.org
SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
31.2 / 100
- Exploited
- Not confirmed
- Reports
- 5
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 30 Jul 2026. No public exploit code or confirmed exploitation is recorded.
- First dated threat reportarcticwolf.com12 mo before
- Disclosedday 0
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Named in 5 threat reports5 reportsarcticwolf.com5Jul 2025 – Jun 2026 · 2 undated
Reports are matched by finding the exact id CVE-2026-28323 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Token Bingo: Don't Let Your Code be the Winner
Mentions the CVE; no further detail.
Dropping Elephant APT Group Targets Turkish Defense Industry With New Campaign and Capabilities: LOLBAS, VLC Player, and Encrypted Shellcode
Mentions the CVE; no further detail.
Blog | Arctic Wolf
Mentions the CVE; no further detail.
Show all 5 reportsShow fewer
Ending Cyber Risk with Aurora Endpoint Security
Mentions the CVE; no further detail.
Also mentioned in 4 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Dark Caracal Reloaded: New Malware, Same Hunting Grounds14 Sep 2026
- Dark Caracal Reloaded: New Malware, Same Hunting Grounds27 Aug 2026
- Dark Caracal Reloaded: New Malware, Same Hunting Grounds26 Aug 2026
- Kwetsbaarheid in SolarWinds Web Help Desk: update nu [Nationaal Cyber Security Centrum - Nieuwsberichten]31 Jul 2026