Vulnerability
Published 2026-09-17
Updated 2026-11-02
Verified 2026-11-02
SolarWinds Access Rights Manager hard-coded key → unauth RCE CVE-2026-28326 (CVSS 8.8); fix 2026.2.1
SolarWinds Trust Center advisory CVE-2026-28326 (first published 17 September 2026) documents an unauthenticated remote code execution flaw in Access Rights Manager (ARM) stemming from a hard-coded static key. CVSS 3.1 8.8 High (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — adjacent network). Affected: ARM 2026.2 and all previous versions. Fixed: ARM 2026.2.1.
Credit: Kai Huang (Armadin). SolarWinds makes no mention of in-the-wild exploitation. (source: SolarWinds Trust Center)
Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: SolarWinds)
- Product
- SolarWinds Access Rights Manager (ARM)
- Versions
- ARM 2026.2 and all previous versions
- CVSS
- (CVSS 3.1 High; SolarWinds)
CVE-2026-28326CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Exploited in Australia?
- unknown
- Patch to
- Upgrade SolarWinds Access Rights Manager to 2026.2.1 (or later fixed release). Restrict ARM management interfaces to trusted admin networks — CVSS attack vector is adjacent (AV:A).