20 SEP 2026 — SolarWinds has patched a hard-coded static key in Access Rights Manager that allows code execution without any credentials. The advisory names no victim, no campaign and no evidence that anyone has used it. That absence is what separates this flaw from most of the ones that get written about.
What the flaw is
CVE-2026-28326 affects Access Rights Manager 2026.2 and every earlier version, and is fixed in 2026.2.1. SolarWinds says the issue stems from a hard-coded static key, and rates it 8.8 on CVSS version 3.1.
Access Rights Manager is used to audit and control who can reach which files and directories. A product built to answer the question of who has access is an awkward place to find an authentication weakness.
The advisory gives no further technical detail about what the key protects or how it is used. Kai Huang of Armadin is credited with reporting it.
Adjacent, not internet-facing
The vector string is where the detail lives: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. AV:A means adjacent network. An attacker has to be on the same local or logical network segment, not simply on the internet. That is a materially smaller set of attackers than "unauthenticated remote code execution" suggests when the phrase travels without its vector.
The rest of the string is unforgiving. Attack complexity is low, no privileges or user interaction are required, and the impact on confidentiality, integrity and availability is high. Once someone is inside the network, nothing else stands in the way.
Why hard-coded keys persist
A hard-coded static key is not a memory-safety mistake or a race condition. It is a design decision that was convenient once, then shipped to every customer because the same value is compiled into every copy of the software. A buffer overflow affects whoever runs the vulnerable build. A shared secret affects everyone who runs any build containing it, and it stays valid until the vendor changes it and every deployment takes the update.
That is also why researchers reading binaries find this kind of flaw more often than defenders watching traffic do. Until someone uses the key, there is nothing anomalous to observe, and once they use it the traffic looks like ordinary authorised activity.
What is not claimed
The advisory contains no statement about exploitation in the wild, and The Hacker News noted that SolarWinds makes no mention of the flaw being exploited. We reported yesterday on a workflow server patched in June whose flaw is being attacked now. The two sit at opposite ends of the same problem: there, a fix existed and attackers arrived before the patching did; here, a fix exists and nobody has yet been seen trying. Where an organisation sits between those two is not knowable from a CVSS score. It depends on whether the product faces a network an attacker has already reached.
What to do now
Confirm the running version is 2026.2.1 or later. Then confirm which network segments can reach the Access Rights Manager server at all. Until the patch is applied, the adjacency requirement is the control doing the work.
SolarWinds carries a particular history here. The 2020 supply-chain compromise of its Orion platform is why this vendor's advisories get read closely. This is a different product and a different class of defect, and the attention reflects that episode rather than a judgement about this one.
No figure has been published for how many installations are exposed. Public exposure counts do not exist for most enterprise software, which is part of why patch urgency is hard to calibrate from outside.
View author profile → · Editorial policy
