{"id":"CVE-2026-111283","title":"BMC Helix Network Management before 26.3.01 Authentication Bypass via SAML Configuration","summary":"BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Atta…","severity":"critical","cvss":9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-305"],"vendor":"BMC Helix","product":"BMC Helix Network Management","affected":["network_management < 26.3.01"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T16:35:50.466717Z"},"published":"2026-10-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T17:09:07.207Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111283","references":[{"url":"https://docs.helixops.ai/bin/IT-Operations-Management/Operations-Management/BMC-Helix-Network-Management/NetworkManagement/Release-Notes/On-prem-Release-Notes/BMC-Helix-Network-Management-26-3-01-On-prem-Release-Notes/"},{"url":"https://www.vulncheck.com/advisories/bmc-helix-network-management-before-26.3.01-authentication-bypass-via-saml-configuration","label":"VulnCheck Advisory: BMC Helix Network Management before 26.3.01 Authentication Bypass via SAML Configuration"}],"tags":["cve.org"],"epss":0.00425,"epssPercentile":0.35302,"ingestedAt":"2026-10-15T22:48:25.449Z","slug":"CVE-2026-111283","body":"## Overview\n\nBMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web login page to obtain a SuperAdmin session, modify device credentials, run device commands, and alter audit records.\n\n## Affected\n\n- `network_management < 26.3.01`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":49.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}