SolarWinds Issues Critical Patch for ARM Vulnerability Allowing Unauthenticated Remote Code Execution

SolarWinds has rolled out a set of security patches to fix a critical weakness in its Access Rights Manager (ARM) product, a flaw that could let attackers run arbitrary code on vulnerable systems without any authentication.

The defect, catalogued as CVE-2026-28326, received a severity rating of 8.8 out of 10 from the Common Vulnerability Scoring System, placing it in the high‑risk category. According to the vendor, the vulnerability stems from a hard‑coded cryptographic key that can be leveraged to bypass normal access controls and execute malicious payloads remotely.

Security researchers who first disclosed the issue warned that exploitation does not require valid credentials, making it especially dangerous for organizations that rely on ARM to manage user permissions across Windows environments. If an attacker were able to trigger the flaw, they could potentially gain full control of the affected server, install ransomware, exfiltrate data, or use the compromised host as a foothold for further lateral movement.

SolarWinds’ advisory advises all customers to apply the released updates immediately. The patches replace the hard‑coded key with a dynamically generated one and tighten validation routines that previously allowed malformed requests to reach the execution layer. The company also recommends reviewing firewall rules and network segmentation to limit exposure of ARM services to trusted segments only.

While the vendor has not disclosed the exact number of installations affected, ARM is widely deployed in enterprises for role‑based access control, making the patch a priority for a broad swath of IT departments. Analysts note that the timing of the disclosure aligns with a recent uptick in supply‑chain‑related attacks, underscoring the need for rapid remediation.

Industry observers say the incident highlights a recurring challenge in software security: the reliance on static secrets embedded in code. Moving toward more robust key management practices and regular code audits can reduce the likelihood of similar vulnerabilities emerging in the future.

Going forward, SolarWinds has pledged to increase its vulnerability‑management cadence and to provide more transparent communication about security fixes. Customers are encouraged to monitor the company’s security portal for additional guidance and to verify that the patches have been successfully applied across all ARM instances.