CVE-2026-28326

SolarWinds Access Rights Manager (ARM) contains an unauthenticated remote code execution flaw caused by a hardcoded static cryptographic key (CWE-321). An attacker who can reach the ARM service from an adjacent network, as reflected in the CVSS attack vector, can abuse the static key to bypass authentication and execute code without any user interaction or credentials. Successful exploitation yields high-impact code execution on the ARM server, which typically holds privileged Active Directory and service credentials, creating significant lateral-movement risk. Organizations running ARM on-premises, most commonly mid-size and large enterprises managing file-server and AD permissions, are affected. No public proof-of-concept is known, the issue is not on the CISA KEV list, and there are no confirmed reports of exploitation in the wild.

What to do: Upgrade SolarWinds Access Rights Manager to the fixed release identified in the SolarWinds security advisory (specific fixed version not stated in the available data). Until patched, restrict network access to the ARM server to dedicated management segments or VPN, since exploitation requires adjacent network access, and monitor ARM hosts for unexpected processes and outbound connections. Because ARM stores privileged directory credentials, treat any suspected compromise as potential domain compromise and rotate the credentials it manages.