SolarWinds patches ARM hard-coded key flaw enabling unauthenticated RCE

September 19, 2026 at 02:31 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

SolarWinds released security updates on September 17, 2026, to fix a high-severity flaw in Access Rights Manager (ARM) that could allow unauthenticated remote code execution. The vulnerability, CVE-2026-28326, carries a CVSS score of 8.8 and affects ARM 2026.2 and earlier. The company credited researcher Kai Huang with discovering the hard-coded static key issue, now patched in ARM 2026.2.1.

Key Facts

CVE-2026-28326 is rated 8.8 out of 10.0 on the CVSS scoring system.
The flaw affects all versions of Access Rights Manager 2026.2 and prior.
SolarWinds credited Armadin security researcher Kai Huang with discovering and reporting the flaw.
The issue stems from a hard-coded static key, according to SolarWinds' advisory.
SolarWinds makes no mention of the vulnerability being exploited in the wild.

ARM Vulnerability Details

The vulnerability, tracked as CVE-2026-28326, is rated 8.8 out of 10.0 on the CVSS scoring system. The issue affects all versions of Access Rights Manager 2026.2 and prior. SolarWinds said in an advisory released on September 17, 2026, that the issue stems from a hard-coded static key. The company credited Armadin security researcher Kai Huang with discovering and reporting the flaw. The flaw has been patched in ARM 2026.2.1.

Related SolarWinds Fixes

The development comes nearly two months after the company shipped fixes for a critical flaw impacting Web Help Desk (WHD) (CVE-2026-28323, CVSS score: 9.8) that could result in a SAML authentication bypass when the SAML 2.0 authentication method is enabled. Another vulnerability relates to a denial-of-service (DoS) vulnerability (CVE-2026-28299, CVSS score: 8.2) that could cause the Web Help Desk server to crash due to insufficient memory. Both issues have been resolved in WHD 2026.2.1. SolarWinds has also released fixes for 16 flaws impacting Serv-U (CVE-2026-28302, from CVE-2026-28304 through CVE-2026-28317, CVE-2026-28321, CVE-2026-28323) that could lead to privilege escalation, remote code execution, and the creation of administrator accounts.