BMC Helix Network Management Has Critical Auth Bypass Before 26.3.01
Unauthenticated attackers can gain SuperAdmin access to BMC Helix Network Management on-prem systems when SAML is enabled, according to NVD data.
Key points
- CVE-2026-111283 is rated CVSS 9.5 Critical by the NVD.
- The flaw allows login as local administrator with any password.
- Only versions before 26.3.01 are affected by this vulnerability.
The National Vulnerability Database lists CVE-2026-111283 as a critical authentication bypass in BMC Helix Network Management. This flaw impacts on-premises installations running versions prior to 26.3.01 and allows attackers to assume full administrative control without valid credentials.
According to the NVD record, the vulnerability carries a CVSS score of 9.5, which is classified as Critical. The weakness is categorized under CWE-305. It specifically affects environments where SAML single sign-on is configured, creating a path for unauthenticated users to bypass standard security checks and access the system.
Technical Details of the Flaw
The vulnerability enables an attacker to submit the administrator username alongside an arbitrary password on the web login page. When SAML single sign-on is active, the system fails to properly validate these credentials. This allows the attacker to obtain a SuperAdmin session immediately, granting complete control over the management platform without needing legitimate login information.
Once inside the system with SuperAdmin privileges, the attacker can modify device credentials stored within the platform. They can also run commands on managed network devices and alter audit records to cover their tracks. This level of access compromises the integrity of the entire network management infrastructure.
Affected Systems and Scope
Only on-premises installations of BMC Helix Network Management are affected by this specific vulnerability. Cloud-hosted or managed service instances are not mentioned in the NVD record. The issue is present in all versions released before 26.3.01. Organizations running older builds must verify their current version to determine if they are exposed to this risk.
The flaw is tied directly to the configuration of SAML single sign-on. If an organization has not enabled SAML, the specific bypass described in the record may not be applicable. However, the NVD description links the exploitability directly to the presence of this single sign-on feature in the affected versions.
What should you do?
No patch or fix has been confirmed in the provided source material. Organizations should verify their current version of BMC Helix Network Management immediately. If running a version before 26.3.01, review SAML configurations and monitor for unauthorized administrative sessions. Contact BMC support for guidance on remediation options.
What to do and how to stay safe: BMC
- Check your current version of BMC Helix Network Management to see if it is before 26.3.01.
- Review SAML single sign-on configurations to understand if the bypass vector is active in your environment.
- Monitor audit logs for unexpected SuperAdmin sessions or changes to device credentials.
- Contact BMC support for official guidance on updating or mitigating this vulnerability.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-111283?
The NVD rates CVE-2026-111283 as 9.5, which is a Critical severity rating.
Which versions of BMC Helix Network Management are affected?
On-premises versions before 26.3.01 are affected by this authentication bypass vulnerability.
Does this require SAML to be enabled?
Yes, the vulnerability allows bypass when SAML single sign-on is configured on the system.
