Cybersecurity
SolarWinds patches Access Rights Manager flaw
SolarWinds issued updates for Access Rights Manager after a reported hard-coded key flaw that could allow unauthenticated remote code execution, and it said the issue was fixed in ARM 2026.2.1.
- SolarWinds said Access Rights Manager was affected by a vulnerability tracked as CVE-2026-28326.
- The company said the flaw came from a hard-coded static key and could allow unauthenticated remote code execution, and it said the fix was in ARM 2026.2.1.
- SolarWinds said the issue affected all versions of Access Rights Manager 2026.2 and earlier.
- The company credited Armadin security researcher Kai Huang with finding and reporting the flaw.
- SolarWinds said it had not seen the vulnerability exploited in the wild.
SolarWinds released security updates for Access Rights Manager on 17 September 2026 after reporting a flaw in the product. The company said CVE-2026-28326 could permit unauthenticated remote code execution because of a hard-coded static key.
The vendor said the problem affected all versions of Access Rights Manager 2026.2 and earlier. It said the fix was included in ARM 2026.2.1.
SolarWinds credited Armadin security researcher Kai Huang with finding and reporting the issue. The company did not say that the vulnerability had been used in attacks.
The ARM update followed earlier fixes from SolarWinds for Web Help Desk. Those included CVE-2026-28323, which could bypass SAML authentication when SAML 2.0 was enabled, and CVE-2026-28299, which could crash the server through low memory.
SolarWinds also said it had fixed 16 Serv-U flaws, naming CVE-2026-28302, CVE-2026-28304 through CVE-2026-28317, CVE-2026-28321 and CVE-2026-28323. It said those bugs could lead to privilege escalation, remote code execution and administrator-account creation.
Named in this story
People
- Kai Huang
- discovered and reported the flaw
Companies
- SolarWinds
- released the Access Rights Manager update and other product fixes
Organisations
- Armadin
- the security research affiliation of Kai Huang
Products and systems
- Access Rights Manager (ARM)
- the SolarWinds product said to contain the flaw
- ARM 2026.2.1
- the patched Access Rights Manager version
- Web Help Desk (WHD)
- another SolarWinds product for which fixes were issued
- Serv-U
- another SolarWinds product that received fixes
How the source tells it
The article kept a straight advisory register, but the severity scoring and exploitability language made it read as alarmed security news.
- alarm severity scoring and unauthenticated remote code execution wording