CVE-2026-111283 affects BMC Helix Network Management in its on-prem edition. Published by NVD on October 15, 2026 and rated 9.0, it's an authentication bypass that yields a SuperAdmin session without knowing the password.
| Field | Value |
|---|---|
| CVSS 3.1 | 9.0 (CRITICAL) |
| Vector | AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD published | 2026-10-15 |
| CISA KEV | no (as of writing) |
| Fixed version | 26.3.01 (per NVD) |
What the Flaw Does
allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured
The irony is hard to miss: the flaw only exists when SAML SSO is configured — that is, on exactly the installations that went to the trouble of centralising authentication. In that case, the web login page accepts the local administrator account whatever password is entered.
The vector reflects that condition: AC:H (high complexity, since SAML configuration is a prerequisite) and S:C (changed scope, since the impact spills from the application onto the devices it manages). Hence 9.0 rather than 9.8 — but if you've enabled SAML, the condition is met and the complexity no longer protects you.
Why It Matters: an NMS Holds the Keys to the Network
A network management tool isn't just another application. It stores credentials for the entire estate — SSH accounts, SNMP communities and users, controller access — and it's authorised to push commands to every router, switch and firewall.
NVD lists what a SuperAdmin session allows here:
- modifying device credentials;
- running commands on devices;
- altering audit records.
The third point is the most worrying for incident response: an attacker can erase their tracks in the very tool meant to keep them. So don't rely solely on the platform's internal audit to know whether you've been hit.
Versions
NVD marks versions before 26.3.01 as vulnerable and 26.3.01 as the fixed release. The CVE only covers the on-prem edition; NVD doesn't mention SaaS deployments — check the BMC advisory for your case.
Detection
- Local administrator sessions: on an installation using SAML SSO, this account should hardly ever be used. Any recent login needs an explanation.
- External logs: the web server, reverse proxy or your SIEM keep a record the attacker couldn't rewrite from within the application. Compare them with the internal audit; a mismatch is a strong signal.
- On the devices: configuration changes, credential changes or command executions initiated from the NMS outside change windows — check the routers' and switches' own logs, or your syslog server.
- Accounts and credentials recently modified in the platform.
Mitigation
- Upgrade to 26.3.01.
- Meanwhile, restrict access to the web interface to admin networks (VPN, bastion). An NMS console has no business on the internet.
- Review the local administrator account: strong password, and disable or restrict it if BMC allows that alongside SAML.
- If compromise is suspected: rotate every device credential stored in the platform, then check device configurations against an earlier backup. That's the real scope of the incident.
Why Continuous Monitoring of Your Network Management Tools Matters
An NMS is the most privileged tool on the network, and often the least watched. A CVE that only triggers once SSO is enabled is a reminder that good security practice doesn't replace version tracking.
With cveo.tech, inventory your network management tools with exact versions and get alerted whenever a critical CVE affects them.