High severity · published Sep 17, 2026
CVE-2026-28326
SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
Access Rights Manager · SolarWinds
2026.2 and all previous versions · source: vendor
In the news
VulnerabilityHigh
SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE
SolarWinds has released security updates to address a high-severity flaw in Access Rights Manager (ARM) that, if successfully exploited, could lead to an unauthenticated remote code execution vulnerability.
The vulnerability, tracked as CVE-2026-28326, is rated 8.8 out of 10.0 on the CVSS scoring system. The issue affects all versions of Access Rights Manager 2026.2 and prior.
"SolarWinds
Sep 19, 2026·The Hacker News
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-28326
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-28326
documentation.solarwinds.com
https://documentation.solarwinds.com/en/success_center/arm/content/secure-your-arm-deployment.htm
documentation.solarwinds.com
https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/arm_2026-2-1_release_notes.htm
www.solarwinds.com
https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28326
More from Access Rights Manager
9.8
CVE-2024-23473
The SolarWinds Access Rights Manager was found to contain a hard-coded credential authentication bypass vulnerability
9.8
CVE-2023-35187
The SolarWinds Access Rights Manager was susceptible to a Directory Traversal Remote Code Vulnerability
9.8
CVE-2023-35184
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability
9.8
CVE-2023-35182
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability
9.6
CVE-2024-23479
SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability