SolarWinds Patches Hard-Coded Key Flaw in Access Rights Manager

SolarWinds has released security updates addressing a high-severity vulnerability in its Access Rights Manager (ARM) product. If successfully exploited, it allowed an attacker to remotely execute arbitrary code without passing authentication.

The flaw was assigned the identifier CVE-2026-28326 and a CVSS score of 8.8 out of 10. According to the advisory published on September 17, 2026, the issue affects all versions of Access Rights Manager 2026.2 and earlier. The root of the vulnerability is a hard-coded static key. The fix was included in ARM version 2026.2.1.

SolarWinds credited the discovery and reporting of the vulnerability to security researcher Kai Huang of Armadin. The company noted no signs of the flaw being exploited in real-world attacks.

Not an Isolated Case

This is not the first notable fix in SolarWinds products in recent months. Almost two months earlier, the company addressed a critical vulnerability in Web Help Desk (WHD) — CVE-2026-28323, rated 9.8, which allowed SAML authentication to be bypassed when the SAML 2.0 method was enabled. At the same time, it also patched a denial-of-service vulnerability (CVE-2026-28299, rated 8.2): due to a lack of memory, the Web Help Desk server could crash. Both issues were resolved in WHD 2026.2.1.

In addition, SolarWinds released fixes for 16 vulnerabilities in the Serv-U product all at once. Together, they could lead to privilege escalation, remote code execution, and the creation of administrator accounts.

Keys and passwords baked into code remain one of the most persistent mistakes in enterprise software: a single secret, identical across all installations, turns into a universal skeleton key the moment it falls into the wrong hands. Access Rights Manager users should install the update to version 2026.2.1 without delay.

Source: The Hacker News