Author: DigitalSpying Security Desk
Date: September 20, 2026
Executive Summary
In a critical security bulletin highlighting the persistent hazard of hard-coded cryptographic credentials in enterprise identity software, SolarWinds has released maintenance updates for SolarWinds Access Rights Manager (ARM). The vulnerability, cataloged as CVE-2026-28326, carries a CVSS severity score of 8.8 and allows an unauthenticated, remote attacker to achieve arbitrary code execution across the host system.
Discovered and reported by cybersecurity researcher Kai Huang of Armadin and detailed by The Hacker News, the flaw resides in the use of a hard-coded static cryptographic key within ARM’s internal service communication routines. Because the identical secret is compiled directly into the software binaries across all customer installations, remote adversaries can forge authenticated payloads and invoke privileged service methods without presenting valid user credentials. Because Access Rights Manager sits at the core of enterprise identity governance—holding elevated access to Active Directory, Microsoft Exchange, and enterprise file servers—compromising an ARM server provides attackers with a high-speed conduit to complete domain escalation. SolarWinds has remediated the flaw in ARM version 2026.2.1.
Deep-Dive Technical Analysis
1. Vulnerability Architecture: Hard-Coded Cryptographic Key (CWE-798)
SolarWinds Access Rights Manager is designed to automate, audit, and enforce user access policies across on-premises Active Directory domains, Microsoft Entra ID (Azure AD), file systems, and corporate email systems:
* Service Communication Fabric: The platform operates through a multi-tier client-server architecture consisting of the central ARM Server daemon, web console components, database interfaces, and background task dispatchers communicating over Windows Communication Foundation (WCF) and message broker channels.
* The Cryptographic Flaw (CWE-798): In versions 2026.2 and prior, internal service authentication and data serialization routines utilized a static, hard-coded cryptographic key embedded directly into the software's compiled .NET assemblies.
* Payload Forgery & Deserialization: Because the static key is identical across all customer deployments globally, an unauthenticated attacker who extracts the key from public binaries can craft mathematically valid, encrypted command payloads.
* Remote Code Execution: When the ARM service accepts and decrypts the forged command message, it evaluates the payload within its high-privilege service runtime, granting the remote attacker arbitrary code execution without requiring prior authentication.
+----------------------------------------------------------------------------------------------------+
| CVE-2026-28326 EXPLOITATION ARCHITECTURE |
|---|+----------------------------------------------------------------------------------------------------+
[Unauthenticated Remote Attacker]
|
| 1. Extracts Hard-Coded Static Cryptographic Key from Compiled ARM Binaries
v
[Forges Privileged Encrypted Command Payload (CWE-798 / CVSS 8.8)]
|
| 2. Transmits Forged Payload to SolarWinds ARM Server Over Network
v
[SolarWinds Access Rights Manager Service]
|
| 3. Decrypts & Validates Payload using Shared Static Key (Authentication Bypassed)
v
[Executes Injected Commands with ARM Service Account Privileges]
|
+---> Compromises Local Host (NT AUTHORITY\SYSTEM / High-Privilege Account)
+---> Interrogates Connected Active Directory Domains & Exchange Servers
+---> Grants Rogue Permissions & Creates Backdoor Domain Administrator Accounts
2. The Identity Governance Dilemma: The Highest-Value Target
Compromising an Identity Governance and Administration (IGA) tool presents catastrophic systemic risks:
* Excessive Standing Permissions: To automate user onboarding, group policy synchronization, and ACL changes, ARM service accounts are routinely granted Domain Admin, Enterprise Admin, or Account Operator permissions in corporate Active Directory environments.
* Domain Dominance via Identity Tooling: An attacker who achieves remote code execution within the ARM service does not need to deploy noisy credential dumpers like Mimikatz; they can simply instruct ARM's native administrative modules to grant administrative rights to any attacker-controlled account, evading behavioral anomaly detection.
3. Broader Context: SolarWinds Enterprise Security Remediation Cycle
CVE-2026-28326 follows an intensive period of vulnerability disclosures spanning SolarWinds' enterprise IT management suite:
Product
CVE Identifier
Severity
Flaw Description
Web Help Desk (WHD)
CVE-2026-28323
CVSS 9.8
Unauthenticated SAML 2.0 authentication bypass
Web Help Desk (WHD)
CVE-2026-28299
CVSS 8.2
Memory-exhaustion Denial-of-Service crash
Serv-U File Server
CVE-2026-28302 – 28323
CVSS 9.0+
16 vulnerabilities enabling privilege escalation and RCE
Access Rights Manager
CVE-2026-28326
CVSS 8.8
Hard-coded static key enabling unauthenticated RCE
4. Technical Vulnerability Specification
Attribute
Technical Specification
Vulnerability ID
CVE-2026-28326
CVSS v3.1 Score
8.8 (High)
Weakness Enumeration
CWE-798: Use of Hard-coded Credentials
Affected Versions
SolarWinds Access Rights Manager 2026.2 and prior
Fixed Version
SolarWinds ARM 2026.2.1
Reported By
Kai Huang (Armadin)
Industry Impact: Securing the Keys to the Kingdom
The discovery of hard-coded cryptographic secrets in identity management software spotlights a glaring architectural blind spot:
* The Paradox of Security Software: Organizations deploy tools like Access Rights Manager specifically to prevent privilege creep and enforce the Principle of Least Privilege. However, when the security tool itself harbors basic cryptographic flaws like hard-coded keys, it becomes an expressway for total network compromise.
* The Persistence of Static Secrets: Hard-coded keys remain a prevalent software development vulnerability due to developers relying on shared secrets for internal RPC convenience rather than implementing dynamic, per-tenant public key infrastructure (PKI).
Strategic Recommendations & Actionable Defenses
1. Upgrade to ARM 2026.2.1 Immediately
Apply the ARM 2026.2.1 update across all primary and secondary Access Rights Manager servers. The release eliminates the static key, transitioning internal service messaging to dynamic, per-installation cryptographic certificates.
2. De-Privilege ARM Service Accounts
Audit all service accounts utilized by SolarWinds ARM. Strip full Domain Admin privileges and transition to granular, delegated Active Directory permissions scoped strictly to organizational units (OUs) requiring automated provisioning. Where supported, migrate service accounts to Group Managed Service Accounts (gMSAs) with automatic, high-entropy password rotation.
3. Network Isolation of Administrative Tooling
Isolate SolarWinds ARM management servers within dedicated, restricted administrative network subnets. Ensure that ARM management listeners are completely inaccessible from standard corporate user VLANs and wireless networks.
4. Active Directory Telemetry Auditing
Inspect Active Directory security event logs (Event ID 4720: User Creation; Event ID 4728: Member Added to Security Group; Event ID 4738: User Account Modified) for unexpected changes originating from the ARM server IP or service account.