SolarWinds patches a hardcoded key in Access Rights Manager

SolarWinds has shipped a fix for a high-severity flaw in its Access Rights Manager (ARM) tooling that lets an attacker run code on a vulnerable server without logging in first. The cause is plainly stated in the vendor's own advisory: a hardcoded static key.

The vulnerability is tracked as CVE-2026-28326 and rated 8.8 on the CVSS scale. Every version of Access Rights Manager up to and including 2026.2 is affected, and the fix arrives in ARM 2026.2.1. SolarWinds credits security researcher Kai Huang of Armadin with finding and reporting the issue. The advisory does not say the flaw has been exploited.

Read the scoring vector before you panic

The published CVSS vector matters as much as the headline number. It reads AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and the AV:A in that string means an adjacent-network attack. A would-be attacker needs a foothold on the same network segment as the ARM server rather than a route in from the open internet, with low attack complexity, no privileges and no user interaction. Once there, the confidentiality, integrity and availability impact is rated high on all three counts.

That combination is not a shrug. Access Rights Manager is the sort of tool that sits inside the perimeter by design, cataloguing who can reach what across an estate, and it is usually deployed and maintained by the administrators whose credentials it exists to govern. A hardcoded key is also a design-time fault rather than a coding slip: it cannot be rotated, it is identical on every deployment an attacker has seen, and it survives network segmentation arguments.

A messy patch cycle for SolarWinds customers

ARM is not the only SolarWinds product that has needed attention this quarter. The same 2026.2.1 release cycle for SolarWinds Web Help Desk closed a 9.8-rated SAML authentication bypass, CVE-2026-28323, along with an 8.2-rated denial-of-service flaw, CVE-2026-28299, that could crash the server on insufficient memory. Administrators running both products on the same management network are patching two unrelated problems in the same window.

Our opinion

Hardcoded keys are the most avoidable class of serious vulnerability there is, because nothing about writing the code requires one. A shipped, identical secret is a single point of failure copied across every customer, and once a researcher extracts it, the vendor's only real remedy is the release it has just published. That is not a design trade-off anyone is forced into in 2026.

The adjacent-network vector will let some teams deprioritise this, and they will be wrong more often than they are right. The machines that carry access-management software are precisely where a low-cost foothold hurts most, and SolarWinds, of all vendors, has spent five years arguing that trust in its tooling has to be earned back after the 2020 Orion compromise. A fix that ships quietly on a Thursday advisory page is technically complete and reputationally incomplete. Customers should rotate anything the key could reach, not just install 2026.2.1.