SolarWinds shipped an out-of-band fix on September 17, 2026 for CVE-2026-28326, a critical flaw in Access Rights Manager (ARM) that lets an attacker with network access to the product run arbitrary code on the host without authenticating. ARM manages Active Directory, Exchange, and file-server permissions for enterprises, which makes an unauthenticated RCE against it a direct path to the identity infrastructure that governs everything else.

What happened

CVE-2026-28326 is a CWE-321 (use of a hard-coded cryptographic key) issue in ARM’s backend services. ARM’s components communicate over an RPC-style interface protected by a cryptographic key that is supposed to be unique per deployment. Instead, the key is baked into the shipped binaries — identical across every installation. Anyone who extracts it from a copy of the software (trivial, since ARM is commercially available) can forge the authentication token that interface expects, talk to the service as if they were a trusted internal component, and reach code paths that execute commands on the host.

The CVSS 3.1 score is 8.8, with the vector reflecting an adjacent-network attack (AV:A) that requires no privileges and no user interaction, and that yields high impact to confidentiality, integrity, and availability. “Adjacent network” here means an attacker who can reach the ARM management interfaces — the same internal segment as the domain admins and helpdesk staff who use the product — not necessarily the public internet. That is a meaningfully lower bar than it sounds: ARM deployments are frequently reachable from broad internal VLANs, jump boxes, or VPN-connected endpoints rather than sitting on a hardened management-only network.

Security researcher Kai Huang of Armadin is credited with discovering and reporting the flaw.

Technical details

  • CVE: CVE-2026-28326
  • CWE: CWE-321 (Use of Hard-coded Cryptographic Key)
  • CVSS 3.1: 8.8 (High) — AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • Affected: SolarWinds Access Rights Manager 2026.2 and all prior versions
  • Fixed in: ARM 2026.2.1
  • Prerequisite: Network access to ARM’s backend service interfaces; no credentials required
  • Outcome: Arbitrary remote code execution on the ARM host

Because the key is static across the product rather than generated per install, there is no meaningful per-customer variance for an attacker to work around once the key is known — it is a skeleton key for every unpatched ARM deployment reachable on the network.

Impact assessment

ARM is not a peripheral tool. It sits with elevated rights across Active Directory, Exchange, file servers, and SharePoint specifically so it can audit and modify who has access to what. Code execution on the ARM host typically means:

  • Direct compromise of the service account ARM runs as, which is commonly granted broad read/write rights over AD objects and group memberships to do its job.
  • A pivot point into identity infrastructure. An attacker who can run commands on ARM can dump cached credentials, manipulate group policy or AD ACLs through ARM’s own delegated permissions, and use the box as a beachhead to reach domain controllers.
  • Loss of the audit trail ARM exists to provide. If the tool meant to catch unauthorized access changes is itself the intrusion vector, detection gets harder, not easier.

SolarWinds has not indicated exploitation in the wild as of the advisory’s publication, but the combination of “unauthenticated,” “hard-coded secret,” and “identity-adjacent software” is exactly the profile that turns into a rapid proof-of-concept once researchers or attackers reverse the shipped key — which for a static, unchanging value only has to happen once. SolarWinds’ Serv-U and N-central products have both seen KEV-listed exploitation within weeks of disclosure this year, so treat the quiet advisory as a head start, not a guarantee of quiet.

Mitigation

  1. Patch to ARM 2026.2.1 immediately. This replaces the static key with a properly generated one; there is no supported workaround that preserves functionality without patching, since the flaw is baked into the shipped software rather than a misconfiguration.
  2. Restrict network reachability to ARM’s service ports. Until patched, isolate ARM backend interfaces to a dedicated management VLAN with access limited to the systems and administrators that need it — don’t rely on general internal-network trust boundaries.
  3. Audit ARM’s own logs and the AD/Exchange objects it has rights over for unexplained changes, especially group membership or delegation changes, going back to when the advisory details became public.
  4. Review the ARM service account’s effective permissions. If it has more access than its actual job requires, scope it down — a hard-coded key elsewhere in the stack shouldn’t translate into unrestricted domain impact.
  5. Track SolarWinds’ Trust Center advisory for this CVE for any updates on exploitation status or additional IOCs.

Sources: The Hacker News, SecurityWeek, SolarWinds Trust Center advisory for CVE-2026-28326.