BMC Helix Network Management: SAML login path accepts any password for the local administrator

Impact

When SAML single sign-on is configured, the on-prem web login accepts the local administrator username with an arbitrary password and hands back a SuperAdmin session. In a datacenter that manages its switch and fabric estate through this platform, that session is the keys to the network: the attacker can read and change stored device credentials, push commands to managed devices, and edit audit records to cover the trail. For a GPU fleet the blast radius is the east-west fabric and the management VLAN, not one host - a change pushed to leaf switches can break or reroute tenant and storage traffic across the whole cluster. The stored device credentials are themselves reusable against every box the platform touches, so recovery means rotating them, not just patching.

Who can reach it

Anyone who can reach the management web UI over the network. No authentication and no prior credentials are needed - only a valid administrator username - and the issue applies to deployments configured for SAML SSO.

What to do

Upgrade the on-prem deployment to 26.3.01 or later per the vendor release notes; this is an application-tier upgrade and restart, not a node reboot, but the service window takes network management offline. Until the upgrade lands, restrict the UI to a jump host or management ACL. Because device credentials and audit records may already have been read or altered, rotate all credentials stored in the platform and review device configuration and audit history after patching.

References

Related entries

• Arista EOS P4Runtime: unauthenticated client can gain full administrative control of the switchCVE-2026-73453 · Arista EOS (P4Runtime service)Critical
• Juniper Junos Space: stored XSS lets a low-privileged user run commands as a viewing administratorCVE-2025-59978 · Juniper Junos Space (web UI stored cross-site scripting)Critical
• Arista EOS gNSI Certz: crafted Rotate request runs arbitrary OS commands as rootCVE-2026-73447 · Arista EOS (gNSI Certz service, also Bootz)Critical
• Arista EOS: gRPC OpenConfig requests authorized at the wrong privilege levelCVE-2026-73461 · Arista EOS (AAA authorization for gRPC/OpenConfig)Critical
• Lantronix console servers: command injection in the NFS download CLI yields root on the out-of-band management deviceCVE-2026-80151 · Lantronix SLC8000/SLC9000/EMG console servers (CLI 'set nfs download' command)Critical
• Arista EOS (redundant supervisor, RPR/SSO): On modular chassis with dual supervisors running RPR or SSO redundancyCVE-2023-24509 · Arista EOS (redundant supervisor, RPR/SSO)Critical