SolarWinds Access Rights Manager RCE flaw patched

SolarWinds has released security updates to fix a high-severity vulnerability in SolarWinds Access Rights Manager (ARM), an identity and permissions management product that organisations use to control who can reach which files, folders and systems inside their network. The flaw, tracked as CVE-2026-28326, could allow an attacker to run their own code on a vulnerable server without logging in first, which is what security professionals call an unauthenticated remote code execution vulnerability. SolarWinds published its advisory on September 17, 2026, and rated the issue 8.8 out of 10.0 on the CVSS scoring system, a widely used scale for describing how serious a security bug is.

According to the advisory, the problem comes down to a hard-coded static key. In plain language, that means a secret value used by the software was written directly into the product by its developers rather than being created fresh for each customer installation. A secret that ships inside the software is not really a secret: anyone who obtains the product, or studies it, can find that value, and because it is the same everywhere it cannot simply be changed by the customer. SolarWinds states that the issue affects all versions of Access Rights Manager 2026.2 and prior, and that it has been patched in ARM 2026.2.1. The company credited Kai Huang, a security researcher at Armadin, with discovering and reporting the flaw. The advisory makes no mention of the vulnerability having been exploited in the wild, which means that as far as SolarWinds has stated publicly, there is no known evidence of attackers using it against customers. That is worth stating plainly rather than as reassurance, because it is a statement about what is known, not a guarantee about what is happening.

The Access Rights Manager fix arrives as part of a broader wave of patching at SolarWinds. Nearly two months earlier, the company shipped fixes for a critical flaw affecting Web Help Desk (WHD), its IT service management tool. That issue, CVE-2026-28323, carries a CVSS score of 9.8 and could result in a SAML authentication bypass when the SAML 2.0 authentication method is enabled. SAML is a widely used standard that lets one system log users in on behalf of another, so a bypass in that mechanism can matter a great deal: it means the step that is supposed to prove who a user is could be skipped or subverted. A second Web Help Desk problem, CVE-2026-28299, is a denial-of-service vulnerability rated 8.2, in which the Web Help Desk server could crash because of insufficient memory. A denial-of-service flaw does not hand an attacker control of data, but it can take a service offline. Both issues have been resolved in WHD 2026.2.1 according to the source information.

SolarWinds has also released fixes for 16 flaws affecting Serv-U, its managed file transfer product, which organisations often use to move files securely between internal systems and external partners. The advisory identifiers given for that batch are CVE-2026-28302, a range running from CVE-2026-28304 through CVE-2026-28317, plus CVE-2026-28321 and CVE-2026-28323. The possible outcomes described for these Serv-U issues are privilege escalation, meaning an attacker with limited access could gain higher rights than they should have; remote code execution, meaning an attacker could run their own code on the affected system; and the creation of administrator accounts, which would give an intruder a lasting way back into the environment. Taken together with the Access Rights Manager bug, the pattern is familiar to anyone who runs infrastructure software: a vendor discloses a batch of issues at once, and administrators are expected to apply the fixes quickly.

For website owners, businesses and IT teams, the practical lesson is about the tools that sit behind a website rather than the website itself. Access Rights Manager, Web Help Desk and Serv-U are typically deployed inside a company network and are often reachable from the internet or from partner connections, which is exactly the position an attacker wants: a system with high privileges that a stranger can talk to. A hard-coded key problem is especially awkward because no amount of careful configuration by the customer removes it; only the vendor can replace the shipped value with something safer, which is what the patched release does. Until that update is installed, the exposure remains exactly as it was on the day the software was built. The reassuring part of this particular story is the disclosure itself: the researcher reported the flaw, the vendor acknowledged it, and a fixed version exists. The unreassuring part is that the fixed version does nothing at all until somebody installs it.

It is also worth keeping the scale of these disclosures in perspective. Each CVE in the Serv-U list is a separate defect, and a list of them is not the same thing as 16 active attacks. What the source describes is a set of vulnerabilities that have been identified and resolved, with no statement about exploitation in the wild for the Access Rights Manager issue. Readers who want to judge their own risk should look at which of these products they actually run, which versions are installed, and whether those systems are exposed to the internet at all. Where a system is exposed, the fixed version should be treated as urgent rather than routine, because remote code execution flaws on internet-facing infrastructure are the kind that attackers scan for automatically once the details become public.

Organisations that would like help assessing which of their own systems are running affected versions, or that need support tightening how these management and file transfer tools are exposed, can look at AEU-I, which provides security first IT, infrastructure and consulting services and can be reviewed at aeu-i.com. The point is not that this story involved anyone at AEU Group, because it did not; it is simply that keeping an inventory of installed products and their versions is the same basic habit that makes vendor advisories like this one actionable.

The source information does not say how quickly customers are expected to upgrade, nor whether SolarWinds has published any workaround for organisations that cannot patch immediately. It also does not describe the technical mechanism by which the hard-coded key could be turned into remote code execution. Those are gaps in what is publicly stated, and they are worth naming rather than filling in with guesses. What is verifiable is narrower and still useful: a high-severity flaw exists in Access Rights Manager 2026.2 and earlier, it has been patched in 2026.2.1, the researcher who found it has been credited, and other SolarWinds products received their own fixes in the same period.