{"id":"CVE-2026-111283","title":"BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration","summary":"BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configur…","severity":"critical","cvss":9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-305"],"vendor":"BMC Helix","product":"BMC Helix Network Management","affected":["network_management >= 26.3.00 < 26.3.01"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T16:35:50.466717Z"},"exploitAvailable":true,"published":"2026-10-15","updated":"2026-10-20","sourceUpdated":"2026-10-20T10:46:34.636Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111283","references":[{"url":"https://docs.helixops.ai/bin/IT-Operations-Management/Operations-Management/BMC-Helix-Network-Management/NetworkManagement/Release-Notes/On-prem-Release-Notes/BMC-Helix-Network-Management-26-3-01-On-prem-Release-Notes/"},{"url":"https://github.com/cybliminal/cve-2026-111283-bmc-helix-network-management-local-administrator-any-password"},{"url":"https://www.vulncheck.com/advisories/bmc-helix-network-management-before-26.3.01-authentication-bypass-via-saml-configuration","label":"VulnCheck Advisory: BMC Helix Network Management before 26.3.01 Authentication Bypass via SAML Configuration"}],"tags":["cve.org","exploit-available"],"epss":0.00766,"epssPercentile":0.55282,"exploits":{"github":1,"githubRepos":["https://github.com/cybliminal/cve-2026-111283-bmc-helix-network-management-local-administrator-any-password"],"checkedAt":"2026-10-27T16:56:54.069Z"},"ingestedAt":"2026-10-15T22:48:25.449Z","slug":"CVE-2026-111283","body":"## Overview\n\nBMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web login page to obtain a SuperAdmin session, modify device credentials, run device commands, and alter audit records.\n\n## Affected\n\n- `network_management >= 26.3.00 < 26.3.01`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":62,"depthScoreParts":{"impact":49.5,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":223907,"id":"CVE-2026-111283","ts":1792268673866,"field":"exploit_available","old":"false","new":"true"}]}