SolarWinds ARM hard-coded key enables unauthenticated RCE
Hard-coded static key in SolarWinds Access Rights Manager through 2026.2 lets unauthenticated attackers execute arbitrary code remotely. Fixed in ARM 2026.2.1.
- Vendor
- SolarWinds
- Product
- Access Rights Manager (ARM)
- CVSS
- 8.8
- EPSS (exploit probability)
- 0.7%
- Status
- patched
- Published
Is CVE-2026-28326 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-28326 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-11 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.7% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-11. Full cross-catalog view: /kev-comparison
CVE-2026-28326 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
A static key hard-coded into SolarWinds Access Rights Manager (ARM) through version 2026.2 lets an unauthenticated attacker bypass authentication and execute arbitrary code on the server. No credentials required to trigger the flaw.
Fixed in ARM 2026.2.1, released September 17, 2026. SolarWinds reports no evidence of exploitation in the wild as of the advisory date. Researcher Kai Huang of Armadin reported the vulnerability.
Upgrade to ARM 2026.2.1. Full version details and upgrade steps are in the SolarWinds advisory. If patching is not immediately possible, restrict network access to the ARM management interface to trusted hosts.
Other SolarWinds CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-28325 SolarWinds Observability Self-Hosted RCE via Deserializationwrite-up | [ HIGH ] | 8.8 | 1.5% | — |
| CVE-2026-28324 SolarWinds Observability Self-Hosted Unauth RCEwrite-up | [ CRITICAL ] | 9.8 | 0.7% | — |
| CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability | [ HIGH ] | 7.5 | 48.0% | |
| CVE-2025-26399 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 90.6% | |
| CVE-2025-40536 SolarWinds Web Help Desk Security Control Bypass Vulnerability | [ HIGH ] | 8.1 | 73.6% | |
| CVE-2025-40551 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 84.2% | |
| CVE-2024-28987 SolarWinds Web Help Desk Hardcoded Credential Vulnerability | [ CRITICAL ] | 9.1 | 93.3% | |
| CVE-2024-28986 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 84.6% |
