[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faupycGCkRtqtMncSOQxQ0nMsnwbf17RlQhj7_shI6EU":3},{"article":4,"iocs":45,"watch_terms":65,"solutions":66,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"1d032fe5-17c8-4935-8cd1-1f93f1ff25f7","SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE","solarwinds-patches-arm-hard-coded-key-flaw-enabling-unauthenticated-rce-531e97","SolarWinds has released security updates to address a high-severity flaw in Access Rights Manager (ARM) that, if successfully exploited, could lead to an unauthenticated remote code execution vulnerability. The vulnerability, tracked as CVE-2026-28326, is rated 8.8 out of 10.0 on the CVSS scoring system. The issue affects all versions of Access Rights Manager 2026.2 and prior. \"SolarWinds","SolarWinds has released security updates to fix a critical vulnerability (CVE-2026-28326) in its Access Rights Manager (ARM) software. The flaw, rated 8.8 CVSS, stems from a hard-coded static key and allows for unauthenticated remote code execution. The company also recently patched other vulnerabilities in Web Help Desk and Serv-U.","SolarWinds patches high-severity RCE flaw in Access Rights Manager due to hard-coded key.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fsolarwinds-patches-arm-hard-coded-key.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjXW-SaTg898BaxxlrDjSCrcm6ZYDgxoeuYCBY4QNWs6Nt5RhyphenhyphenCf4iSIyodz-7jk8rTqUT8hjlMT74dIf6ZjL_pD5NmiNbAHhsZwzw2rakJUDaU1tVeEvKw7Az3tMf34Xwh3ffToJeI1tpTQ8rAR8AvVn2XTupFgfhehb9sHClHDDGeDd4Y9z4oUf5CYPoS\u002Fs1600\u002Fsolar.jpg","2026-09-19T09:31:17+00:00","2026-09-19T12:00:20.604651+00:00",8,[17,20,23,25],{"name":18,"type":19},"Access Rights Manager","product",{"name":21,"type":22},"SolarWinds","vendor",{"name":24,"type":19},"Web Help Desk",{"name":26,"type":19},"Serv-U","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,40],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,50,53,56,59,61,63],{"type":47,"value":48,"context":49},"cve","CVE-2026-28326","SolarWinds Access Rights Manager RCE vulnerability",{"type":47,"value":51,"context":52},"CVE-2026-28323","SolarWinds Web Help Desk SAML authentication bypass vulnerability",{"type":47,"value":54,"context":55},"CVE-2026-28299","SolarWinds Web Help Desk denial-of-service vulnerability",{"type":47,"value":57,"context":58},"CVE-2026-28302","SolarWinds Serv-U vulnerability",{"type":47,"value":60,"context":58},"CVE-2026-28304",{"type":47,"value":62,"context":58},"CVE-2026-28317",{"type":47,"value":64,"context":58},"CVE-2026-28321",[21,18,24],{"controls":67,"vendors":154},[68,96,125],{"slug":69,"name":70,"problem":71,"products":72},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[73,81,88],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":69,"product_name":85,"url":86,"description":87},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":97,"name":98,"problem":99,"products":100},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":126,"name":127,"problem":128,"products":129},"patch-management","Automated patch management","Known holes get closed in days, not months.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":147,"vendor_name":148,"vendor_logo":149,"product_slug":150,"product_name":151,"url":152,"description":153},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",[],{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":173},"hard-coded-key-in-solarwinds-arm-enables-unauthenticated-remote-code-execution","Hard-Coded Key in SolarWinds ARM Enables Unauthenticated Remote Code Execution","SolarWinds Access Rights Manager contained a hard-coded static cryptographic key — a fundamental secure development failure — that allowed any unauthenticated attacker to achieve remote code execution with a CVSS score of 8.8. Hard-coded credentials and keys are a well-known anti-pattern that bypass all authentication controls, effectively leaving a permanent backdoor built into the product itself. This is particularly dangerous in Access Rights Manager software, which is designed to control and audit privileged access across an organization, meaning a compromise could cascade into full environment takeover. The recurrence of critical CVEs across multiple SolarWinds products (ARM, Web Help Desk, Serv-U) highlights systemic secure development lifecycle (SDLC) gaps. Organizations relying on this software for privileged access governance face compounded risk if patching is delayed.",[160,161,162,163,164,165,166,167,168,169,170,171,172],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 12: Network Infrastructure Management","CIS Control 16: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 IA-5: Authenticator Management (prohibiting hard-coded credentials)","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 SA-11: Developer Testing and Evaluation","NIST Cybersecurity Framework: ID.RA-1 (Asset Vulnerabilities Identified)","OWASP A02:2021 – Cryptographic Failures","OWASP A05:2021 – Security Misconfiguration","GDPR Article 32: Security of Processing (for organizations processing EU personal data via ARM)","CISA KEV Catalog: Monitor for SolarWinds entries",{}]