SolarWinds released patches today for a critical authentication bypass flaw in Access Rights Manager that exposes organizations to unauthenticated remote code execution attacks.
The vulnerability, CVE-2026-28326, carries a CVSS score of 8.8, indicating high severity. The flaw stems from a hard-coded cryptographic key embedded in ARM versions 2026.2 and earlier. An attacker with network access to an affected ARM instance can exploit this key to bypass authentication entirely and execute arbitrary code on the server without credentials.
Access Rights Manager serves as a privileged access management solution for enterprise environments. Organizations deploy ARM to control and monitor administrative access across IT infrastructure, databases, and cloud resources. The platform handles sensitive operations including password management, session recording, and access policy enforcement. A successful exploit of this vulnerability allows attackers to completely circumvent these protections.
The hard-coded key vulnerability represents a fundamental design flaw rather than a logic error. Attackers can reverse-engineer the ARM application to extract the static cryptographic key, then use it to forge valid authentication tokens or bypass encryption protections designed to secure administrative functions. This attack requires no interaction with legitimate users and works against default or hardened configurations equally.
Organizations running ARM 2026.2 or earlier should treat this as a priority patch. The vulnerability enables attackers to establish persistent footholds within identity and access infrastructure. Once compromised, ARM becomes a pivot point for lateral movement throughout corporate networks. An attacker with ARM access can modify user permissions, steal credentials stored in the system, or use the platform to escalate privileges across connected systems.
The CVSS 8.8 rating reflects the combination of network accessibility, lack of authentication requirements, and ability to execute code with system privileges. The impact scope extends beyond the ARM application itself to dependent systems and users managed through it.
SolarWinds has not disclosed public exploitation of CVE-2026-28326 at the time of patch release. Organizations should nevertheless assume threat actors are analyzing the vulnerability immediately upon disclosure. Exploitation typically follows vulnerability publication within days or weeks for flaws of this severity.
Patch deployment should follow this sequence. First, identify all ARM instances within your environment, including development and test systems running production versions. Second, test patches in non-production environments to verify compatibility with dependent applications and integrations. Third, schedule maintenance windows for production patch deployment, prioritizing instances accessible from external networks. Fourth, implement network segmentation to restrict ARM access to authorized administrative users only, preventing lateral movement if compromise occurs before patching.
Organizations unable to patch immediately should implement compensating controls. Restrict network access to ARM administrative interfaces through firewall rules and VPN requirements. Monitor ARM logs for failed authentication attempts and unusual administrative activities. Consider disabling ARM features not actively in use to reduce attack surface. Implement multi-factor authentication for ARM user accounts as an additional security layer.
SolarWinds customers should verify patch application across all ARM deployments and confirm version numbers reflect the patched release. The vendor's security advisory contains specific version numbers for patched releases and detailed remediation guidance.