CVE-2026-111283

Received Received - Intake

Authentication Bypass in BMC Helix Network Management

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web login page to obtain a SuperAdmin session, modify device credentials, run device commands, and alter audit records.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111283

Affected Vendors & Products

Vendor	Product	Version / Range
BMC	Helix	BMC Helix Network Management 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-305	The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

Attack-Flow Graph

Executive Summary

This vulnerability is an authentication bypass in BMC Helix Network Management on-prem versions before 26.3.01. When SAML single sign-on is configured, unauthenticated attackers can log in as the local administrator by submitting the administrator username with any password on the web login page. This grants a SuperAdmin session, allowing attackers to modify device credentials, run commands, and alter audit records.

Impact Analysis

This vulnerability allows attackers to gain full administrative access to the BMC Helix Network Management system. They can change device settings, execute unauthorized commands, and manipulate audit logs, leading to potential data breaches, system compromise, or unauthorized network access.

Compliance Impact

This vulnerability can severely impact compliance with GDPR, HIPAA, and other regulations by enabling unauthorized access to sensitive data and system configurations. It may lead to data breaches, loss of audit trail integrity, and failure to meet security and privacy requirements, resulting in legal penalties and reputational damage.

Mitigation Strategies

Upgrade BMC Helix Network Management to version 26.3.01 or later to address the authentication bypass vulnerability. Disable SAML single sign-on if not required until the update is applied.

Hi! I’m here to help you understand CVE-2026-111283. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70