SolarWinds ARM CVE-2026-28326: Unauthenticated RCE

SolarWinds ARM CVE-2026-28326 is a CVSS 8.8 unauthenticated remote code execution flaw in SolarWinds Access Rights Manager caused by a hard-coded cryptographic key (CWE-321). Any attacker who can reach an affected ARM server can abuse the shared static key to execute code without logging in. It affects ARM 2026.2 and all earlier versions and is fixed in ARM 2026.2.1, so upgrade now.

Access Rights Manager is the SolarWinds product organizations use to govern who can access what across Active Directory, file servers, and other systems, which makes an unauthenticated RCE in it especially sharp: the tool that audits and controls access becomes the way in. According to The Hacker News, the flaw stems from a hard-coded static key baked into the software, the kind of secret that is identical across every deployment and, once extracted from the product, works against all of them. Researcher Kai Huang of Armadin reported it, and SolarWinds says it has no indication of exploitation in the wild as of disclosure.

A hard-coded key (CWE-321, use of a hard-coded cryptographic key) is dangerous precisely because it defeats the purpose of authentication. When the same secret ships to every customer, an attacker only has to recover it once, from a downloaded copy, a decompiled binary, or documentation, and then present it to any exposed instance to be trusted. That is why this rates CVSS 8.8 despite requiring no credentials: the barrier is not a password an attacker must guess but a key that was never really secret. SolarWinds remains a name attackers watch closely after the 2020 supply-chain incident, so an unauthenticated ARM RCE will draw scanning quickly even without confirmed in-the-wild use.

What is CVE-2026-28326 and how does the attack work?

CVE-2026-28326 is an unauthenticated remote code execution vulnerability in SolarWinds Access Rights Manager rooted in a hard-coded cryptographic key. Because the key is static and shared across installations, an attacker who obtains it can bypass authentication and reach code-execution paths on the ARM server over the network, with no valid account required. The practical result is full compromise of a system that, by design, holds broad visibility into an organization's access rights.

Which SolarWinds ARM versions are affected and fixed?

There is no credential or configuration prerequisite for the attacker, so the remediation is the upgrade itself. Treat any internet-reachable ARM instance as the priority, and restrict management interfaces to trusted networks while you patch.

Is CVE-2026-28326 being exploited?

SolarWinds makes no mention of active exploitation at disclosure, and the flaw is not in CISA KEV. That is the moment to move, not the reason to wait. A hard-coded-key bug in a widely deployed access-governance product is low-effort to weaponize once the key is public, and EPSS already sits in the mid-40th percentile. The gap between "not yet exploited" and "mass scanned" for an unauthenticated RCE in a SolarWinds product is usually measured in days.

Our read

The uncomfortable lesson in a hard-coded key is that it was a latent backdoor shipped in good faith: the product was never as authenticated as its login screen implied. That is exactly the class of assumption continuous verification exists to catch, because a configuration review or a compliance checkbox will happily confirm "authentication is enabled" while a shared static key quietly makes it optional. The defensible move is to verify by design, prove that an unauthenticated request actually fails against your ARM instance, rather than trusting that it should. A CVSS score tells you how bad the flaw is, not whether your specific deployment is exposed, and for a security tool that governs access, that difference is the whole game.

Reporting by The Hacker News; CVSS 8.8 and CWE-321 per the NVD record; discovery credited to Kai Huang of Armadin. Sources linked above.

Frequently asked questions

What is CVE-2026-28326?
It is a CVSS 8.8 unauthenticated remote code execution vulnerability in SolarWinds Access Rights Manager caused by a hard-coded cryptographic key (CWE-321), letting an attacker who has the shared key execute code without authenticating.

How do I fix CVE-2026-28326?
Upgrade SolarWinds Access Rights Manager to version 2026.2.1. All 2026.2 and earlier releases are affected, and there is no configuration-only workaround; restrict access to the management interface while patching.

Is CVE-2026-28326 being exploited in the wild?
SolarWinds reports no known exploitation at disclosure and it is not in CISA KEV, but a hard-coded-key unauthenticated RCE is quick to weaponize once the key is public, so patch without waiting for confirmation.

Why is a hard-coded key so serious?
Because the same secret ships to every customer. An attacker recovers it once and can then authenticate to any exposed instance, which is why the flaw is unauthenticated in practice despite a login existing.