1. Executive summary
SolarWinds has patched CVE-2026-28326, a hard-coded cryptographic key flaw (CWE-321) in Access Rights Manager (ARM) that permits unauthenticated remote code execution. The vulnerability is rated CVSS 8.8 HIGH, affects all versions of ARM 2026.2 and prior, and is fixed in ARM 2026.2.1. It is not in the CISA KEV catalogue and carries an EPSS score of 1%, and SolarWinds makes no mention of in-the-wild exploitation. ARM is a privileged identity and access auditing tool that typically holds credentials for directory services and file systems across the estate, so a successful exploit gives an attacker a strong foothold for credential harvesting and lateral movement. EMEA financial services clients running ARM should treat this as a high-priority patch, not an emergency: no observed exploitation, but the unauthenticated RCE path and the product's privileged position make the exposure unacceptable to carry.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 24: digital operational resilience testing — general requirements | ARM is an access-rights auditing product whose compromise would corrupt the integrity of the identity and access data used to evidence access reviews; a hard-coded key flaw in that product is a defect in a tool that itself supports resilience testing and access governance | Fold ARM version verification into the resilience testing cycle: confirm ARM 2026.2.1 or later is deployed and record the check as test evidence |
| DORA Art. 28: ICT third-party risk — general principles | ARM is SolarWinds third-party software holding credentials to in-scope ICT systems, and the flaw is a defect in that third party's product | Verify the installed ARM version against the vendor advisory as part of third-party risk management of the SolarWinds relationship |
No NIS2 or UK NIS article is engaged at a level beyond generic patching hygiene; no incident has occurred and no exploitation has been reported.
3. Technical analysis & attack chain
CVE-2026-28326 is a use of hard-coded cryptographic key vulnerability (CWE-321) in SolarWinds Access Rights Manager. SolarWinds' advisory, quoted by The Hacker News, states: "SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hard-coded static key." The flaw affects all versions of ARM 2026.2 and prior and is fixed in ARM 2026.2.1. The researcher credited with the discovery is Kai Huang of Armadin.
The confirmed attack chain, as far as the source supports it:
- The attacker reaches a vulnerable ARM instance (version 2026.2 or earlier). The source does not specify the required network posture, port, or protocol, so treat any reachable instance as exposed until verified.
- The attacker exploits the hard-coded static key. Because the key is static and embedded, it is identical across installations; an attacker who recovers it from one instance or from the product binary can use it against every unpatched deployment.
- The result is unauthenticated remote code execution on the ARM host.
The source provides no detail on the specific protocol or endpoint through which the key is used, the privilege level of the resulting execution, or post-exploitation behaviour. Do not assume a web endpoint; the mechanism is unconfirmed. What is confirmed is the outcome: code execution without authentication on a system that, by design, holds service and administrative credentials for Active Directory, file servers, and other connected resources. That credential store is the primary target of anyone who lands on an ARM server.
Context from the same vendor cycle: SolarWinds shipped the ARM fix alongside patches for Web Help Desk (CVE-2026-28323, CVSS 9.8, SAML authentication bypass when SAML 2.0 is enabled; CVE-2026-28299, CVSS 8.2, DoS via insufficient memory, both fixed in WHD 2026.2.1) and 16 flaws in Serv-U (CVE-2026-28302, CVE-2026-28304 through CVE-2026-28317, CVE-2026-28321, CVE-2026-28323) covering privilege escalation, RCE, and administrator account creation. These are separate products and separate remediation tracks; the ARM CVE is the subject of this advisory.
Confidence caveat: all technical detail on CVE-2026-28326 in this advisory is single-sourced, resting on The Hacker News' reporting of the SolarWinds advisory. The verified reference data (CVSS 8.8, CWE-321, not in KEV, EPSS 1%) corroborates the severity and classification. No exploit code, proof of concept, or technical write-up is referenced in the source material.
4. Mitigation & containment
P1, within 24 hours:
- Inventory every ARM deployment and record the version. Anything at 2026.2 or prior is vulnerable.
- Upgrade to ARM 2026.2.1, the vendor fix. If an immediate upgrade is not possible, remove the ARM server from any network-reachable position: restrict the management interface to an administrative VLAN or jump-host path, and block external access at the perimeter firewall until patched.
- Rotate the credentials ARM uses to connect to Active Directory, file servers, and other audited systems on any instance that was internet-reachable or broadly accessible on the internal network before patching. A hard-coded key flaw means an attacker with the key needed no authentication, so treat stored credentials on exposed instances as potentially compromised.
P2, within 72 hours:
- Verify the upgrade completed and the version now reports 2026.2.1 or later.
- Review ARM server logs for unexplained authentication failures, unexpected process execution, or anomalous service activity on the ARM host covering the period before the patch. The source gives no specific log signatures, so this is a general review.
- Confirm whether the same SolarWinds estate includes Web Help Desk or Serv-U; if so, verify those are at WHD 2026.2.1 and current Serv-U patch levels respectively, since the vendor fixed related critical flaws in the same cycle.
P3, within 7 days:
- Add ARM version checks to the standard vulnerability management cycle so future SolarWinds advisories are matched against the estate within the patch SLA.
- Update the third-party risk record for SolarWinds to reflect this advisory and the remediation taken.
5. Indicators of compromise
No indicators of compromise available in the source material.
6. Detection
Insufficient indicators to author detection rules.
CVE assessment
1 referenced CVE
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-28326 | 8.8 High | — | 1% | SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The iss… |
7. Sources
- The Hacker News, "SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE," https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html, 2026-09-19
- SolarWinds security advisory, 2026-09-17, as quoted in the above source (no direct URL provided in the source material)
8. Adverse Trace position
We assess CVE-2026-28326 as high severity on the verified data: CVSS 8.8, CWE-321, not in CISA KEV, EPSS 1%, and no reported in-the-wild exploitation. The risk to EMEA financial services is driven less by the score than by the target: ARM sits on privileged credentials for directory and file infrastructure, so an unauthenticated RCE there converts directly into lateral movement capability. We are not treating this as an incident-driven emergency, but the 24-hour patch window in §4 is justified by the unauthenticated attack path and the product's position. The technical detail is single-sourced from vendor advisory reporting, and we will verify the mechanism, affected component, and any proof-of-concept emergence against the SolarWinds advisory and NVD record as they develop, and will reissue this note if exploitation is observed or the KEV state changes.
Published via PulseTrace — Adverse Trace threat intelligence.