CVE-2026-111283: BMC Helix Network Management before 26.3.01 Authentication Bypass via SAML Configuration
BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web login page to obtain a SuperAdmin session, modify device credentials, run device commands, and alter audit records.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BMC Helix Network Managementto a version that resolves this vulnerability.Fixed in 26.3.01
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
BMC Helix Network Management on-prem deployments before 26.3.01 are affected when SAML single sign-on is configured. The provided information does not indicate that deployments without SAML SSO are affected.
What does an attacker need to exploit the vulnerability?
An attacker needs network access to the web login page and knowledge of the local administrator username. No valid credentials or user interaction are required; any password can be submitted with that username.
What access could an attacker gain after exploitation?
Successful exploitation creates a SuperAdmin session. An attacker could modify device credentials, run device commands, and alter audit records.
How can administrators check for likely exposure?
Verify whether the deployment is on-prem, running a version before 26.3.01, and has SAML single sign-on configured. Affected systems may allow a login attempt using the local administrator username and an arbitrary password to create a SuperAdmin session.