SolarWinds ARM CVE-2026-28326: Update to 2026.2.1 for the Hard-Coded-Key RCE
SolarWinds has fixed an unauthenticated remote-code-execution vulnerability in Access Rights Manager (ARM) caused by a hard-coded static cryptographic key. CVE-2026-28326 affects ARM 2026.2 and all earlier releases; ARM 2026.2.1 is the fixed version. SolarWinds rates the flaw 8.8 High under CVSS 3.1.
The published vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Exploitation therefore requires adjacent-network reachability, while requiring no account, privileges or user interaction. Successful exploitation can compromise confidentiality, integrity and availability of the affected ARM host.
Organizations running ARM should inventory deployed versions and move systems on 2026.2 or earlier to 2026.2.1 or later. The adjacent-network requirement makes management-network segmentation relevant to exposure, especially where ARM services are reachable from broad internal, VPN or other connected network segments.
CVE-2026-28326 at a glance
| Item | Detail |
|---|---|
| Product | SolarWinds Access Rights Manager |
| CVE | CVE-2026-28326 |
| Severity | High, CVSS 3.1 score 8.8 |
| Weakness | CWE-321, use of a hard-coded cryptographic key |
| Affected | ARM 2026.2 and all prior releases |
| Fixed | ARM 2026.2.1 |
| Authentication | None required |
| Attack vector | Adjacent network |
| User interaction | None |
| Impact | Remote code execution; high confidentiality, integrity and availability impact |
SolarWinds published the advisory on September 17, 2026 and credited Kai Huang of Armadin with reporting the vulnerability.
Why the network boundary matters
The CVSS vector marks CVE-2026-28326 as AV:A, or adjacent network. That is narrower than an Internet-routable network attack and materially changes exposure assessment. An attacker still needs network positioning that can reach the vulnerable service.
For enterprise deployments, that boundary can include compromised hosts or identities with access to the management segment. ARM manages access-rights information across systems such as Active Directory and other enterprise resources, so its placement on a privileged management network makes segmentation and reachability review important alongside the software update.
SolarWinds' public advisory identifies the root cause as a hard-coded static key. It does not publish enough protocol-level detail to establish what the key protects or the complete exploit sequence. Operators can act on the affected-version and network-vector information without relying on an inferred exploit mechanism.
What administrators should do
Upgrade ARM to 2026.2.1 or a later fixed release. Version 2026.2.1 is the vendor-provided remediation for CVE-2026-28326.
For environments where the update requires a maintenance window, review which hosts and network segments can reach ARM services and restrict that reachability to required management systems. This is a compensating exposure-reduction measure; the vendor update remains the remediation.
After patching, confirm the running ARM build rather than relying only on package-download or deployment records. Teams with centralized vulnerability management should also search for older ARM instances, including secondary, test and disaster-recovery systems that may not follow the primary server's update cycle.
Detection and incident review
The vendor advisory does not provide public indicators of compromise or a detailed exploit trace. Detection should therefore start from local telemetry: review access to the ARM host from unexpected adjacent-network systems, anomalous process execution, configuration changes and other activity inconsistent with the server's normal management role.
Organizations that identify suspicious activity should preserve relevant host, authentication and network logs before remediation where incident-response requirements permit. A vulnerability scanner showing an affected version establishes exposure; it does not by itself establish exploitation.
Evidence and remediation boundary
SolarWinds' advisory and the CVE record agree on the affected range, fixed release, hard-coded-key weakness and CVSS vector. Independent reporting published September 19 also corroborates the 2026.2.1 remediation and unauthenticated RCE impact.
No reviewed primary source establishes active exploitation of CVE-2026-28326. The practical decision is therefore version- and reachability-driven: ARM 2026.2 and earlier should be updated, with adjacent-network access tightened where patching cannot be completed immediately.
Sources
- SolarWinds security advisory: https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28326
- SolarWinds ARM 2026.2.1 release notes: https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2026-2-1_release_notes.htm
- CVE-2026-28326 record and references: https://www.cve.org/CVERecord?id=CVE-2026-28326
- Independent reporting, The Hacker News, September 19, 2026: https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html