SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE
SolarWinds patched CVE-2026-28326 (CVSS 8.8), a hard-coded-key flaw enabling unauthenticated remote code execution in Access Rights Manager 2026.2 and prior.
SolarWinds released ARM 2026.2.1 on September 17, 2026 to fix CVE-2026-28326, an unauthenticated remote code execution flaw in Access Rights Manager caused by a hard-coded static key, reported by Armadin researcher Kai Huang. The company stated there is no evidence of exploitation in the wild. The same cycle resolved Web Help Desk issues CVE-2026-28323 (CVSS 9.8, SAML authentication bypass) and CVE-2026-28299 (CVSS 8.2, denial-of-service), plus 16 Serv-U flaws enabling privilege escalation, RCE, and administrator account creation.
- CVE-2026-28326 (CVSS 8.8) stems from a hard-coded static key allowing unauthenticated RCE in ARM 2026.2 and prior.
- Fixed in Access Rights Manager 2026.2.1; credited to Armadin researcher Kai Huang; no in-the-wild exploitation reported.
- SolarWinds also fixed WHD SAML authentication bypass CVE-2026-28323 (CVSS 9.8) and DoS flaw CVE-2026-28299 (CVSS 8.2).
- Sixteen Serv-U flaws enabling privilege escalation, remote code execution, and administrator account creation were also patched.
- CVEs
- CVE-2026-28299CVE-2026-28302CVE-2026-28304CVE-2026-28317CVE-2026-28321CVE-2026-28323CVE-2026-28326
- Vendors
- SolarWinds
- Organizations
- SolarWindsArmadin
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-28299 | SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due… | 7.5 | <1% | ||
CVE-2026-28304+3 related CVEs | SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root | 9.1 | <1% | ||
| CVE-2026-28323 | SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability | 9.8 | <1% | ||
| CVE-2026-28326 | Unauthenticated RCE in SolarWinds Access Rights Manager via hardcoded static key | 8.8 | <1% | PoC |
From the original article
1 min read at thehackernews.com
SolarWinds has released security updates to address a high-severity flaw in Access Rights Manager (ARM) that, if successfully exploited, could lead to an unauthenticated remote code execution vulnerability. The vulnerability, tracked as CVE-2026-28326, is rated 8. 8 out of 10.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.