SolarWinds Issues Urgent Security Patch for High-Severity Remote Code Execution Flaw in Access Rights Manager

SolarWinds has released vital security updates to address a high-severity vulnerability affecting its Access Rights Manager (ARM) platform. If successfully exploited, the flaw could allow malicious actors to achieve unauthenticated remote code execution on vulnerable systems, posing a significant risk to organizational identity security and network infrastructure.

The vulnerability, officially tracked and cataloged as CVE-2026-28326, carries a high severity rating of 8.8 out of a maximum 10.0 on the Common Vulnerability Scoring System (CVSS). According to the security advisory published by SolarWinds, the issue impacts all versions of the Access Rights Manager platform up to and including version 2026.2.

In its advisory released on September 17, 2026, the company detailed the root cause of the security gap. SolarWinds stated that the Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability stemming specifically from the use of a hard-coded static key. The presence of a hard-coded cryptographic key or secret in software often allows attackers who discover the key to bypass authentication mechanisms entirely, potentially gaining deep administrative access or executing arbitrary commands without needing prior credentials or legitimate user access.

The discovery of the flaw highlights ongoing challenges that enterprise software vendors face regarding secure coding practices, particularly around cryptographic key management and secure initialization routines. Hard-coded keys remain a recurring issue across the broader software industry, as they can be extracted through reverse engineering or code analysis if they are embedded directly within application binaries or configuration files.

SolarWinds credited security researcher Kai Huang, affiliated with Armadin, with discovering and responsibly reporting the vulnerability. Prompted by the disclosure, the software developer moved quickly to engineer a fix, releasing Access Rights Manager version 2026.2.1 to neutralize the threat. At the time of the advisory release, SolarWinds noted that it had received no indication or evidence that CVE-2026-28326 was being actively exploited in the wild by cybercriminals or state-sponsored threat actors. Nevertheless, because of the high severity rating and the potential for unauthenticated exploitation, security teams and system administrators are strongly urged to apply the latest patch immediately.

The release of the ARM security update arrives nearly two months after SolarWinds shipped fixes for another severe vulnerability impacting a different core product, Web Help Desk (WHD). That critical flaw, tracked as CVE-2026-28323, received a maximum CVSS severity score of 9.8. It exposed organizations to a SAML authentication bypass whenever the SAML 2.0 authentication method was actively enabled within the Web Help Desk environment, allowing unauthorized users to circumvent standard identity verification controls.

Alongside the SAML authentication bypass, the Web Help Desk security update also addressed a separate denial-of-service vulnerability identified as CVE-2026-28299, which carried a CVSS score of 8.2. This particular flaw could cause the Web Help Desk server to crash unexpectedly due to insufficient memory management when subjected to specific inputs or abnormal workloads. Both of those critical issues were successfully resolved and bundled into Web Help Desk version 2026.2.1.

In addition to the ARM and WHD advisories, SolarWinds has also rolled out comprehensive patches for a significant cluster of 16 vulnerabilities impacting Serv-U, its popular file transfer and management software. These flaws—encompassing CVE-2026-28302, as well as a consecutive block ranging from CVE-2026-28304 through CVE-2026-28317, alongside CVE-2026-28321 and CVE-2026-28323—collectively exposed systems to severe security risks. If exploited, these Serv-U vulnerabilities could enable malicious actors to achieve privilege escalation, execute remote code, or maliciously create unauthorized administrator accounts on the underlying servers, giving attackers persistent and elevated access to corporate networks.

The cadence of recent security advisories from enterprise infrastructure vendors underscores the continuous pressure technology companies face to secure complex codebases against sophisticated attack vectors. For enterprise environments utilizing SolarWinds products, the latest wave of patches emphasizes the critical importance of maintaining a robust vulnerability management program, monitoring vendor security advisories closely, and applying patches expeditiously to mitigate the risk of compromise.