Overview
SolarWinds has shipped security updates for Access Rights Manager (ARM), its identity and access-governance platform for Active Directory environments, to fix a high-severity flaw that could let an attacker run code on the managed host without ever authenticating. The issue, tracked as CVE-2026-28326, carries a CVSS score of 8.8 and was disclosed in a SolarWinds advisory published September 17, 2026.
The root cause is unusually blunt for a 2026 disclosure: a hard-coded static cryptographic key baked into the product itself, rather than a logic bug or missing input check.
The Vulnerability
According to SolarWinds' advisory, ARM "was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hard-coded static key." The flaw is classified as CWE-321 (Use of Hard-coded Cryptographic Key) — a category where the same secret value ships inside every install of the software, rather than being generated uniquely per deployment.
When a cryptographic key used to sign, encrypt, or validate data is identical across every customer's installation, anyone who extracts that key from one copy of the software effectively holds the key for all of them. If that key gates something like deserialization, a trusted communication channel, or a remote-management interface, an attacker who knows the key can craft input the application will treat as legitimate — without ever needing valid credentials.
The published CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H:
- Attack Vector: Adjacent Network — exploitation requires access to the same local/adjacent network segment as the ARM host, not the open internet
- Attack Complexity: Low, Privileges Required: None, User Interaction: None
- Confidentiality, Integrity, and Availability impact: High across all three
SolarWinds credited security researcher Kai Huang of Armadin with discovering and reporting the issue. As of publication, SolarWinds has not indicated any evidence of exploitation in the wild, and third-party trackers list the flaw's EPSS (exploit prediction) score as very low.
Affected Versions & Fix
| Product | Affected Versions | Fixed Version |
|---|---|---|
| SolarWinds Access Rights Manager | 2026.2 and all prior releases | 2026.2.1 |
Administrators should confirm their ARM instance is running 2026.2.1 or later; anything on 2026.2 or an earlier release line remains exposed until upgraded.
Why It Matters
ARM is a privileged tool by design — it's deployed specifically to manage and audit who has access to what across Active Directory, file servers, Exchange, and SharePoint. A management platform that governs access rights is, almost by definition, sitting close to the crown jewels of an organization's identity infrastructure. An unauthenticated RCE path into that platform gives an attacker a foothold with an unusually high blast radius: from there, they could manipulate access-rights data directly, pivot toward the directory services ARM is meant to protect, or use the compromised host as a launchpad deeper into the network.
The "Adjacent Network" attack vector tempers the exposure somewhat — this isn't an internet-facing, scan-and-exploit bug the way a public-facing appliance flaw would be. But it's a low bar for anyone who already has a foothold inside the corporate LAN, which is precisely the scenario ARM is deployed to help detect and contain.
This disclosure also lands only about two months after SolarWinds patched a critical SAML authentication bypass in Web Help Desk (CVE-2026-28323, CVSS 9.8) and a related denial-of-service flaw (CVE-2026-28299, CVSS 8.2), alongside 16 separate fixes across Serv-U covering privilege escalation, RCE, and unauthorized admin-account creation. Coming so soon after that wave, this advisory is a reminder that SolarWinds' on-prem management tooling remains an active target for researchers and, by extension, a priority patching surface for any org running it.
What Admins Should Do
- Upgrade to ARM 2026.2.1 immediately. There is no workaround published for the hard-coded key itself short of applying the fix — rotating credentials elsewhere does not remove a key embedded in the software.
- Restrict network access to the ARM host to only the management workstations and service accounts that genuinely need it, since the attack vector requires adjacent-network reach.
- Review ARM server and access logs for unexpected connections or activity predating the patch, particularly from unfamiliar internal hosts.
- Check SolarWinds' advisory and release notes directly for the full technical writeup and any indicator-of-compromise guidance published after this article.
- Prioritize this alongside the recent Web Help Desk and Serv-U patches if your environment runs multiple SolarWinds products — treat this as part of a broader "patch the SolarWinds fleet" pass rather than a one-off.
- No exploitation has been confirmed as of this writing, but hard-coded-key flaws with unauthenticated RCE potential tend to get reverse-engineered quickly once a CVE is public — don't treat the current lack of in-the-wild reports as a reason to delay.