SolarWinds has released patches for a serious vulnerability in its Access Rights Manager (ARM) product that could allow remote attackers to execute code without authentication. Rated 8.8 out of 10 on the CVSS scale, this flaw stems from a hard-coded static key embedded in ARM, affecting all versions through 2026.2.
Identified as CVE-2026-28326, the issue was discovered by researcher Kai Huang of Armadin. The patch is included in ARM version 2026.2.1, where the embedded key vulnerability has been addressed. The company said it has seen no evidence of the flaw being exploited in the wild.
Other Related SolarWinds Vulnerabilities Patched
Alongside the ARM fix, SolarWinds closed several other high-severity gaps across its software lineup. A zero-day SAML authentication bypass in Web Help Desk (CVE-2026-28323), which carried a 9.8 CVSS score, has been remedied in version WHD 2026.2.1. Also fixed in the same update is a denial-of-service issue (CVE-2026-28299) that could crash servers due to memory overload.
Furthermore, SolarWinds addressed sixteen flaws in its Serv-U product—spanning CVE-2026-28302 and several up through CVE-2026-28317, plus CVE-2026-28321—covering threats like privilege escalation, remote code execution, and unauthorized admin account creation.
Why This Matters
Hard-coded keys are a classic yet dangerous design flaw, allowing attackers who uncover them to bypass authentication entirely. When combined with remote code execution risk, this kind of bug becomes especially costly. SolarWinds’ swift response—patching ARM, Web Help Desk, and Serv-U in recent updates—underscores both the severity and potential reach of these issues.
Administrators using any ARM version up to 2026.2 should upgrade immediately. Those running WHD or Serv-U should ensure they’re on the latest patched releases. Even if no public exploit has been reported, the risk is too high to ignore—particularly in environments handling sensitive or critical operations.
Long-term, this incident highlights the importance of secure secret management practices in enterprise software. Design reviews and code audits should prioritize eliminating embedded secrets. Developers and vendors will need to strengthen controls around static keys and authentication bypass vectors.
