As reported by The Hacker News, SolarWinds has patched a high-severity unauthenticated remote code execution vulnerability in Access Rights Manager (ARM) stemming from a hard-coded static key. The flaw—CVE-2026-28326 (CVSS 8.8)—affects ARM 2026.2 and earlier, with fixes available in ARM 2026.2.1. No active exploitation has been confirmed.
The Persistent Problem of Hard-Coded Secrets
Hard-coded cryptographic keys (CWE-798) remain one of the most preventable yet embarrassingly common vulnerability classes in enterprise software. When a vendor ships a product with a static key baked into the binary, every deployment shares the same secret. Reverse engineering one instance compromises all customers simultaneously. This is not a subtle logic flaw or a complex memory corruption—it is a software engineering culture failure.
What makes CVE-2026-28326 particularly concerning is the combination of unauthenticated access with remote code execution. An attacker who can reach the ARM service does not need credentials, valid sessions, or any prior foothold. They simply exploit the static key to forge or bypass authentication and execute code in the context of the application. If ARM is internet-exposed—even briefly during migration or misconfiguration—the attack surface is effectively critical, not high.
Why ARM Matters as a Target
Access Rights Manager is not a generic IT management tool. It is purpose-built to inventory, analyze, and report on Active Directory and file system permissions. An attacker who achieves RCE on an ARM server gains access to:
Compromising ARM is, in effect, compromising the organization's understanding of its own access topology. Threat actors can use this intelligence to identify over-privileged accounts, dormant service accounts, and high-value group targets—accelerating downstream attacks including Kerberoasting, privilege escalation, and eventual domain compromise.
SolarWinds' Broader Patch Cycle
This advisory arrives alongside fixes for a critical SAML authentication bypass in Web Help Desk (CVE-2026-28323, CVSS 9.8) and a batch of 16 vulnerabilities in Serv-U spanning privilege escalation, RCE, and rogue administrator account creation. The pattern is familiar: SolarWinds products continue to surface serious authentication and authorization flaws. Given the company's history with the SUNBURST supply-chain attack, every vulnerability disclosure invites heightened scrutiny—and defenders should apply that scrutiny accordingly.
The question is not whether SolarWinds products are uniquely vulnerable, but whether organizations are treating them with the criticality their network position demands. ARM sits adjacent to Active Directory. Treat it like a Tier 0 asset.
Shield53 Recommendations
Immediate Actions
- Patch ARM to 2026.2.1 immediately. If patching cannot be completed within 48 hours, implement network-level restrictions as an interim control.
- Restrict ARM access to management networks only. Confirm no ARM instances are exposed to the internet. Check reverse proxies, load balancers, and accidental cloud NAT rules.
- Apply the Web Help Desk and Serv-U patches if those products are deployed. The WHD SAML bypass (CVE-2026-28323) is critical and should be treated as emergency-priority.
Detection and Hardening
- Audit ARM service accounts for excessive AD permissions. ARM should query AD with read-only delegated rights, not Domain Admin credentials.
- Review ARM server logs for anomalous authentication events, unexpected process spawns, or outbound connections dating back at least 90 days. The vulnerability may have been discoverable before disclosure.
- Deploy application allowlisting on ARM servers (e.g., WDAC or AppLocker) to constrain what executable code can run even if RCE is achieved.
- Network segment ARM servers into a dedicated management VLAN with strict east-west controls. ARM should not have unrestricted access to domain controllers or file servers.
Strategic Posture
- Inventory all SolarWinds deployments across the estate. Track version numbers, exposure status, and patch currency in a central register.
- Reassess whether ARM is required. Native AD tooling, Microsoft Purview, or third-party alternatives may reduce dependency on a vendor with a recurring vulnerability profile.
- Demand transparency from vendors on their secrets management practices. Hard-coded keys should be a procurement disqualifier, not a patch-cycle expectation.
