SolarWinds has issued an urgent security advisory for a high-severity vulnerability in its Access Rights Manager (ARM) product, tracked as CVE-2026-28326. The flaw enables unauthenticated attackers to execute arbitrary code remotely on affected systems, posing a serious risk to organizations using the identity and access governance platform.
The vulnerability arises from a hardcoded static key embedded in SolarWinds Access Rights Manager 2026.2 and all earlier releases. Because the key is static and known, an attacker within adjacent network access can exploit it to bypass authentication entirely and run malicious code with high privileges. SolarWinds rates the issue 8.8 (High) under CVSS v3.1, reflecting severe impacts on confidentiality, integrity, and availability.
Patch availability and upgrade path
SolarWinds has released a fixed version, Access Rights Manager 2026.2.1, which removes the hardcoded key and mitigates the remote code execution risk. Customers are advised to upgrade immediately to 2026.2.1 or later. The advisory, first published on September 17, 2026, includes a downloadable PDF with technical details and recommends that administrators verify their current version and schedule emergency patching where ARM is deployed.
Given the “unauthenticated” and “remote code execution” characteristics, this bug is especially dangerous in environments where ARM is exposed to internal networks or poorly segmented zones. An attacker who gains adjacent network access—such as via a compromised workstation or rogue device—could leverage the static key to take control of the ARM server, potentially escalating to broader identity management systems. The CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates low attack complexity and no need for user interaction, amplifying the urgency for remediation.
Safety tips
Organizations using SolarWinds Access Rights Manager should treat CVE-2026-28326 as a priority patching target. Immediate steps include: confirming the installed ARM version; isolating ARM servers from untrusted network segments; applying the 2026.2.1 update; and monitoring logs for suspicious authentication bypass attempts. Security teams should also review network access controls and consider threat-hunting activities focused on ARM-related processes. As with any identity management platform compromise, the downstream risk to Active Directory and other directories is significant, making rapid mitigation essential.