# SolarWinds Patches Critical ARM Vulnerability Enabling Remote Code Execution High-severity flaw in Access Rights Manager could allow unauthenticated attackers to execute arbitrary code. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-09-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/9b05faed-ee56-4bf4-bad1-8434fac4323a ## Critical Vulnerability in ARM SolarWinds has patched a high-severity vulnerability (CVE-2026-28326) in its Access Rights Manager (ARM) product, rated 8.8 on the CVSS scale. The flaw could allow unauthenticated attackers to execute arbitrary code remotely. The issue affects all versions of ARM prior to 2026.2.1. This marks another significant security issue for SolarWinds, following their high-profile supply chain attack in 2020. ## Root Cause Analysis The vulnerability stems from a hard-coded static cryptographic key in ARM's authentication mechanism. Security researcher Kai Huang discovered and reported the flaw to SolarWinds. While the company hasn't disclosed technical details, hard-coded credentials typically bypass normal authentication checks, providing attackers with privileged access. SolarWinds confirmed no active exploitation in the wild as of the advisory date. ## Immediate Patch Release SolarWinds released ARM 2026.2.1 on September 17, 2026 to address the vulnerability. The company's advisory emphasizes the importance of immediate patching, given the potential for remote code execution without authentication. This update follows industry best practices for responsible disclosure, with credit given to the external researcher who discovered the flaw. ## WHD and Serv-U Vulnerabilities Concurrently, SolarWinds patched a critical SAML authentication bypass (CVE-2026-28323, CVSS 9.8) in Web Help Desk and a DoS vulnerability (CVE-2026-28299, CVSS 8.2). Additionally, they resolved 16 flaws in Serv-U, ranging from privilege escalation to remote code execution. These multiple vulnerabilities across products highlight ongoing security challenges in SolarWinds' software suite. ## Enterprise Security Implications ARM is widely used for managing access rights in enterprise environments. Successful exploitation could grant attackers administrative privileges across entire networks. The vulnerability's unauthenticated nature makes it particularly dangerous, as it doesn't require any user interaction or credentials to exploit. Organizations using affected versions should prioritize patching. ## CVSS Score Breakdown The 8.8 CVSS score indicates high attack vector (network-based), high attack complexity, no privileges required, no user interaction needed, and high impact on confidentiality, integrity, and availability. This scoring suggests the vulnerability could be weaponized relatively easily with significant potential damage. The static key issue would typically score high on the 'security requirements' CVSS metric. ## SolarWinds' Security Track Record This incident follows SolarWinds' 2020 supply chain attack that compromised thousands of organizations. While unrelated, it continues the pattern of serious vulnerabilities in their products. The company has since implemented its Secure by Design initiative, but these recent vulnerabilities suggest ongoing challenges in their security practices, particularly around authentication mechanisms. ## Actionable Recommendations Security teams using SolarWinds ARM should immediately update to version 2026.2.1. Organizations should audit for any unusual activity since the vulnerability's disclosure. The incident underscores the importance of: 1) regular vulnerability scanning, 2) prompt patch management, and 3) defense-in-depth strategies, especially for privileged access management solutions that protect critical systems. ## Sources covering this story - https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._