Solar Winds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE
Summary: SolarWinds released security updates for a high-severity flaw in Access Rights Manager (ARM), tracked as CVE-2026-28326 and rated 8.8 out of 10.0 on the CVSS scale, that could allow unauthenticated remote code execution and stems from a hard-coded static key. The issue affects all versions of Access Rights Manager 2026.2 and prior, was credited to Armadin researcher Kai Huang, and is patched in ARM 2026.2.1, with SolarWinds making no mention of exploitation in the wild.
What you should know: A hard-coded static key means the flaw is baked into every affected deployment of ARM 2026.2 and prior, so an unauthenticated attacker does not need to guess or steal anything to reach remote code execution. The patch arrives nearly two months after SolarWinds fixed a 9.8-rated SAML authentication bypass in Web Help Desk, putting two high-severity paths into the same vendor's products in one quarter.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-28299CVE-2026-28302CVE-2026-28304CVE-2026-28317CVE-2026-28321CVE-2026-28323CVE-2026-28326
- Related
- ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, Click Fix Attacks, Click Fix Surge, and Browser Hijacks Cyber Risks ·⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026