BMC Helix Network Management: Authentication bypass via SAML configuration

Summary

BMC Helix Network Management on-prem releases before 26.3.01 accept any password for the built-in local administrator account when SAML single sign-on is configured. An unauthenticated attacker who can reach the web login page can obtain a SuperAdmin session. From there, the attacker can read and change stored device credentials, run commands on managed network devices and alter audit records.

Affected

• BMC Helix Network Management on-prem 26.3.00 before 26.3.01 (per CVE record)
• Other sources list any version before 26.3.01; the earliest affected release is unknown.
• Only deployments with SAML single sign-on configured are affected. Local or LDAP-only deployments are not affected.

Fixed in

• Fixed in BMC Helix Network Management 26.3.01 (ticket DRR69-3214, released August 24, 2026).
• Patch-level details (hotfix or full release, build numbers): Unknown.

Workaround

• Unknown. No vendor-documented workaround was found.
• Restrict access to the web interface to a management VLAN or VPN until the patch is applied (recommendation from research, not from the vendor).

Exploitation

• No known exploitation in the wild was found; no CISA KEV entry was found.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• A public technical write-up by the reporter exists; its exploit detail was not verified.
• EPSS about 0.77% in one snapshot (rough signal only).

Our recommendation

• Upgrade to BMC Helix Network Management 26.3.01 or later as a priority, especially if the web interface is internet-facing or SAML is enabled.
• Check whether SAML single sign-on is enabled on your instance.
• Review SuperAdmin logins and audit records for unexplained entries.
• If compromise is suspected, rotate stored device credentials.
• Confirm the affected version range against the BMC advisory before final conclusions.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  cybliminal/cve-2026-111283-bmc-helix-network-management-local-administrator-any-password

Research sources

• BMC Helix Network Management 26.3.01 On-prem Release Notes docs.helixops.ai
• Researcher write-up (GitHub, Cybliminal) github.com
• VulnCheck advisory www.vulncheck.com
• BMC Helix SAML 2.0 configuration guide docs.helixops.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:31.