On-prem BMC Helix Network Management before version 26.3.01 has a critical authentication bypass: when SAML single sign-on is configured, an unauthenticated attacker can log in as the local administrator using any password.
What Is It
CVE-2026-111283 is an authentication bypass in BMC Helix Network Management on-prem, classified as CWE-305 (Authentication Bypass by Primary Weakness). On instances with SAML single sign-on configured, an attacker can enter the local administrator username with any password on the web login page and receive a SuperAdmin session.
VulnCheck disclosed the issue, and NVD published it on October 15, 2026. The NVD record is in "Received" status and has not yet been analyzed by NVD.
Why It Matters
The flaw is rated CRITICAL under both CVSS versions:
- CVSS 3.1: 9.0 (
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 9.5. The supplied data includes only the exploitability metrics (
AV:N/AC:L/AT:P/PR:N/UI:N). It does not give the vulnerable-system impact metrics (VC/VI/VA) or the subsequent-system impact metrics (SC/SI/SA). See the NVD record for the full vector.
It can be exploited over the network with no privileges and no user interaction. The one precondition is that SAML SSO must be configured.
With a SuperAdmin session, an attacker can, per the advisory:
- Change device credentials
- Run commands on managed devices
- Alter audit records
This product manages network infrastructure, so the impact can reach the devices it controls. The CVSS 3.1 vector reflects this with a changed scope (S:C). Because attackers can alter audit records, logs on a compromised instance may not be reliable for investigation.
The CISA Known Exploited Vulnerabilities (KEV) catalog has no entry for this CVE, so CISA has not confirmed active exploitation. The supplied data also does not define exploit maturity.
What's Vulnerable
- Vendor: BMC Helix
- Product: BMC Helix Network Management (on-prem)
- Affected versions: All versions before 26.3.01
- Required condition: SAML single sign-on configured
The supplied data lists no specific CPEs.
Patch Status
According to the affected-version data, version 26.3.01 fixes the issue. Admins running on-prem BMC Helix Network Management with SAML SSO enabled should upgrade to 26.3.01 or later. Check the 26.3.01 on-prem release notes for upgrade details. There is no KEV entry, so CISA has set no federal remediation deadline.