The vulnerability in BMC Helix Network Management on‑prem before 26.3.01 allows an unauthenticated attacker who has SAML single sign‑on configured to log in as the local administrator using any password. By submitting the administrator username with an arbitrary password on the web login page, the attacker receives a SuperAdmin session. This session grants the ability to modify device credentials, execute device commands, and alter audit records, effectively compromising confidentiality, integrity, and availability of the managed network devices.

BMC Helix Network Management on‑prem releases earlier than version 26.3.01 are affected. The issue is tied specifically to the SAML configuration feature within the product.

The CVSS score of 9.5 indicates a critical severity. The EPSS score is 0.00425 (0.425%), indicating a very low exploitation probability, and the issue is not listed in CISA KEV. The most likely attack vector is remote via the web login interface; an attacker needs only to provide the admin username and an arbitrary password to achieve a privileged session. Such an exploit requires no special privileges on the target system and can be performed from any remote location with network access to the web service.