Skip to navigation

Threat reportVulnerabilityTL-2026-2585

SolarWinds Access Rights Manager Hard-Coded Cryptographic Key (CVE-2026-28326) Enables Unauthenticated RCE

criticalPATCHED

SolarWinds patched CVE-2026-28326 (CVSS 3.1: 8.8), a hard-coded static cryptographic key (CWE-321) in Access Rights Manager (ARM) 2026.2 and prior that lets an unauthenticated attacker on the adjacent network achieve remote code execution. The fix ships in ARM 2026.2.1; SolarWinds reports no evidence of in-the-wild exploitation, no public PoC exists, and the CVE is absent from the CISA KEV catalog.

Key facts for SolarWinds ARM hard-coded key RCE

IdentifiersTL-2026-2585, CVE-2026-28326
SeverityCRITICAL
CVSS8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Exploitation statusPublic proof-of-concept exploit
EPSSCVE-2026-28326: 0.6% (51.0th percentile)
Affected productsSolarWinds Access Rights Manager
Weaknesses (CWE)CWE-321
MITRE ATT&CK techniquesT1005 Data from Local System, T1046 Network Service Discovery, T1059 Command and Scripting Interpreter, T1068 Exploitation for Privilege Escalation, T1069 Permission Groups Discovery, T1087 Account Discovery, T1098 Account Manipulation, T1190 Exploit Public-Facing Application, T1210 Exploitation of Remote Services, T1211 Exploitation for Defense Evasion, T1484 Domain or Tenant Policy Modification, T1543 Create or Modify System Process and 5 more in the attack flow
MotivationUNKNOWN
Detection rules9 (1 shown free)
Sources12 cited sources

Detection coverage for SolarWinds ARM hard-coded key RCE

As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2585 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: New Service, Scheduled Task, or GPO Change on SolarWinds ARM Host — Post-Exploitation Persistence/Priv-Esc

Detects creation of a new Windows service (4697), a new scheduled task (4698), or a Group Policy object attribute change (5136) on a host identified as a SolarWinds Access Rights Manager server. Because ARM's server component runs with SYSTEM-level privileges (per SolarWinds documentation), a successful CVE-2026-28326 RCE hands an attacker a foothold from which persistence (new service/task) and domain-tier privilege escalation (GPO/domain policy modification, account manipulation) are the expected next steps.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1543, T1068, T1098, T1484
  • Data sources: windows_security, sysmon
  • Severity: high
  • Confidence: medium

Splunk SPL

index=wineventlog sourcetype="WinEventLog:Security" (EventCode=4697 OR EventCode=4698 OR EventCode=5136)
| where match(host, "(?i)(ARM|ACCESSRIGHTS)") OR match(ServiceFileName, "(?i)ARM") OR EventCode=5136
| eval risk_reason="New service/scheduled task or Group Policy object change on/near SolarWinds ARM host - possible post-exploitation persistence or privilege escalation for CVE-2026-28326"
| table _time, host, EventCode, ServiceName, ServiceFileName, TaskName, ObjectDN, AttributeLDAPDisplayName, SubjectUserName, SubjectUserSid
| sort -_time

Microsoft KQL

SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID in (4697, 4698, 5136)
| where Computer has_any ("ARM","ACCESSRIGHTS") or EventID == 5136
| project TimeGenerated, Computer, EventID, Activity, SubjectAccount, ObjectDN=extractjson('$.ObjectDN', tostring(EventData)), ServiceFileName=extractjson('$.ServiceFileName', tostring(EventData))
| order by TimeGenerated desc

Sigma

title: New Service, Scheduled Task, or GPO Change on SolarWinds ARM Host (Post-Exploitation Persistence)
id: 3d4e5f6a-7b8c-4d9e-a0f1-2b3c4d5e6f7a
status: experimental
description: Detects creation of a new Windows service, scheduled task, or Group Policy object attribute change on a host identified as a SolarWinds Access Rights Manager server, consistent with post-exploitation persistence and domain-tier privilege escalation following CVE-2026-28326 RCE.
references:
  - https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28326
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-19
tags:
  - attack.persistence
  - attack.t1543
  - attack.privilege-escalation
  - attack.t1068
  - attack.t1098
  - attack.t1484
  - cve.2026.28326
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4697
      - 4698
      - 5136
  filter_host:
    Computer|contains:
      - 'ARM'
      - 'ACCESSRIGHTS'
  condition: selection and filter_host
falsepositives:
  - Legitimate ARM software update installing a Windows service
  - Scheduled maintenance tasks or approved GPO change-control activity performed by authorized administrators
level: high

Known false positives:

  • Legitimate ARM software update installing a Windows service
  • Scheduled maintenance tasks or approved GPO change-control activity performed by authorized administrators

Tuning notes: Restrict the host filter to your actual ARM server hostname/OU rather than a broad substring match, and cross-reference SubjectUserSid/SubjectAccount against your ARM service-account and change-management allowlist to suppress approved maintenance.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • SolarWinds ARM Service Spawning Command Interpreter — CVE-2026-28326 Exploitation Indicator · unlock with TL Creds
  • New Service, Scheduled Task, or GPO Change on SolarWinds ARM Host — Post-Exploitation Persistence/Priv-Esc · unlock with TL Creds
  • AD Enumeration and Access-Governance Data Staging from SolarWinds ARM Host — Collection/Lateral Prep · unlock with TL Creds
  • SolarWinds ARM Service Spawning Command Interpreter — CVE-2026-28326 Exploitation Indicator · unlock with TL Creds
  • New Service, Scheduled Task, or GPO Change on SolarWinds ARM Host — Post-Exploitation Persistence/Priv-Esc · unlock with TL Creds
  • AD Enumeration and Access-Governance Data Staging from SolarWinds ARM Host — Collection/Lateral Prep · unlock with TL Creds
  • SolarWinds ARM Service Spawning Command Interpreter — CVE-2026-28326 Exploitation Indicator · unlock with TL Creds
  • AD Enumeration and Access-Governance Data Staging from SolarWinds ARM Host — Collection/Lateral Prep · unlock with TL Creds

Indicators of compromise for SolarWinds ARM hard-coded key RCE

As of 2026-09-27, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-2585.

27 indicators of compromise · unlock with TL Creds. Compare plans

How SolarWinds ARM hard-coded key RCE works

On September 17, 2026, SolarWinds published a security advisory and release notes for Access Rights Manager (ARM) 2026.2.1, fixing CVE-2026-28326, a high-severity (CVSS 3.1: 8.8, vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) vulnerability classified CWE-321 (Use of a Hard-coded Cryptographic Key). ARM is SolarWinds' Active Directory / Exchange / NTFS privileged-access-governance product. Multiple independently corroborating sources (SolarWinds' own advisory, NVD/OpenCVE, and third-party CVE trackers) consistently describe the root cause as a hardcoded static key embedded in the ARM application that permits an unauthenticated attacker to achieve remote code execution; none of the reviewed sources published the precise low-level exploitation mechanic (e.g., whether the key is used to sign, encrypt, or authenticate a message ARM's server subsequently trusts and processes), so that detail should be treated as vendor-undisclosed rather than assumed.

The attack vector is rated Adjacent Network (AV:A) rather than Network (AV:N), consistent with SolarWinds' own ARM deployment guidance, which documents ARM's internal server-to-collector and client communication and recommends ARM run on a dedicated, non-internet-facing server, with ARM and the SolarWinds Platform installed on separate servers. An attacker with reachability to ARM's internal service ports — e.g., from an already-compromised host on the same segment or VLAN — is therefore the realistic exploitation scenario, not a direct internet-facing attack. CVE-2026-28326 was reserved on February 26, 2026, publicly disclosed September 17, 2026, and last updated in NVD/OpenCVE on September 18, 2026. FIRST.org EPSS data available at disclosure time scored the CVE at approximately 0.5% exploitation probability (roughly the 55th percentile of all scored CVEs) — consistent with SolarWinds' statement that it has seen no evidence of in-the-wild exploitation and with the absence of any public proof-of-concept exploit code as of this writing.

This is not the first time SolarWinds ARM has shipped with a hard-coded/static secret exposed in its architecture: in September 2024, SolarWinds patched CVE-2024-28990 (hard-coded RabbitMQ credentials permitting authentication bypass to the ARM RabbitMQ management console, CVSS 6.3) alongside CVE-2024-28991 (an authenticated insecure-deserialization RCE yielding SYSTEM-level code execution, CVSS 9.0 per the vendor / 9.9 per Trend Micro Zero Day Initiative, discovered by Piotr Bazydlo of ZDI) — both fixed together in ARM 2024.3.1. CVE-2026-28326 now represents the same class of weakness (embedded/static secret material undermining ARM's trust boundary) in a fully unauthenticated form, a meaningful regression from the 2024 fixes.

CVE-2026-28326 was disclosed as part of a broader SolarWinds September 2026 security update cycle; the same Hacker News report that surfaced ARM's flaw also references concurrent SolarWinds advisories affecting Web Help Desk (CVE-2026-28323, CVE-2026-28299) and 16 flaws across Serv-U (CVE-2026-28302, CVE-2026-28304 through CVE-2026-28317, CVE-2026-28321, CVE-2026-28323). Independent research corroborates that CVE-2026-28323 is a SAML 2.0 authentication-bypass flaw in Web Help Desk (a forged/relayed SAMLResponse to the SAML Assertion Consumer Service endpoint establishes a session without valid credentials) and that CVE-2026-28299 is an unauthenticated denial-of-service flaw in the same product; both were fixed in WHD 2026.2.1. These are separate CVEs in separate SolarWinds products from CVE-2026-28326 and are not themselves mapped into this threat's MITRE/IOC data, but they establish that SolarWinds' privileged-IT-management product line underwent a coordinated multi-product patch cycle in mid-to-late 2026, and that at least one sibling flaw in that cycle (CVE-2026-28318, a Serv-U unauthenticated DoS disclosed in June 2026) was subsequently added to the CISA Known Exploited Vulnerabilities catalog — underscoring that SolarWinds privileged-access and IT-management tooling has been an active target class in 2026, even though CVE-2026-28326 itself carries no confirmed-exploitation evidence.

No technical writeup or proof-of-concept exploit code from discoverer Kai Huang (Armadin) or any third party has been identified as of this writing, and CVE-2026-28326 does not appear in the CISA KEV catalog. Impact is nonetheless rated CRITICAL because of what ARM manages: successful RCE against the ARM server (which SolarWinds documentation indicates runs with SYSTEM-level privileges) would hand an attacker code execution on the system that holds delegated rights to provision, audit, and modify Active Directory, Exchange, and NTFS file-share access — a direct path to account manipulation, AD permission-group discovery, and collection of locally stored access-governance data, independent of whether the attacker pivots further.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Discovery

T1046 Network Service Discovery; T1069 Permission Groups Discovery; T1087 Account Discovery

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1484 Domain or Tenant Policy Modification

Persistence

T1098 Account Manipulation; T1543 Create or Modify System Process

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Defense Evasion

T1211 Exploitation for Defense Evasion

Credential Access

T1552 Unsecured Credentials; T1552.001 Unsecured Credentials: Credentials In Files

Resource Development

T1587.004 Develop Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities

Reconnaissance

T1595.002 Active Scanning: Vulnerability Scanning

Remediation for SolarWinds ARM hard-coded key RCE

Patches

  • SolarWinds Access Rights Manager 2026.2.1

Immediate actions

  • Upgrade all SolarWinds Access Rights Manager deployments to version 2026.2.1 or later immediately
  • Restrict network access to ARM server/collector/client communication ports to trusted management hosts only via firewall/IP allowlisting
  • Confirm ARM is not reachable from general user VLANs, guest networks, or the internet
  • Verify ARM and the SolarWinds Platform are installed on separate servers per current vendor deployment requirements

Workarounds

  • No official workaround was published; SolarWinds' advisory and release notes direct customers to upgrade to 2026.2.1

Longer-term hardening

  • Deploy ARM on a dedicated server isolated from general enterprise network segments, per SolarWinds' own hardening guidance
  • Rotate RabbitMQ and other ARM internal service credentials/certificates after upgrading
  • Apply network segmentation that isolates privileged identity/access-management infrastructure (ARM, AD tier-0 assets) from standard user and server VLANs
  • Monitor ARM server logs and adjacent-network traffic for anomalous connections to ARM management ports
  • Track and patch sibling SolarWinds products (Web Help Desk, Serv-U) disclosed in the same September 2026 update cycle, since at least one related Serv-U flaw (CVE-2026-28318) was independently added to CISA KEV

Affected and fixed versions

  • SolarWinds — Access Rights Manager
    Vulnerable versions: 2026.2; all versions prior to 2026.2
    Fixed in: 2026.2.1

Timeline of SolarWinds ARM hard-coded key RCE

Last updated · revalidated 1× · latest source

  • locked-ioc-18 discloses and patches CVE-2024-28990 (hard-coded RabbitMQ credentials) and CVE-2024-28991 (insecure-deserialization RCE, discovered by Piotr Bazydlo of Trend Micro ZDI, CVSS 9.0/9.9) in ARM 2024.3.1 — the earlier instance of embedded-secret weaknesses in ARM's internal messaging architecture.
  • CVE-2026-28326 is reserved in the CVE numbering system, ahead of public disclosure.
  • locked-ioc-18 discloses sibling denial-of-service flaws CVE-2026-28299 (Web Help Desk) and CVE-2026-28318 (Serv-U), part of the same vendor's broader 2026 IT-management-product patch cadence; the Canadian Centre for Cyber Security publishes advisory AV26-549.
  • CISA adds the related locked-ioc-18 Serv-U flaw CVE-2026-28318 to the Known Exploited Vulnerabilities catalog, confirming active exploitation of a sibling locked-ioc-18 product in the same 2026 disclosure cycle (distinct from CVE-2026-28326, which is not KEV-listed).
  • locked-ioc-18 patches CVE-2026-28323, a SAML 2.0 authentication-bypass vulnerability in Web Help Desk, in WHD 2026.2.1 — another sibling flaw in the same product family disclosed in the months leading up to CVE-2026-28326.
  • locked-ioc-18 releases Access Rights Manager 2026.2.1, which fixes CVE-2026-28326 and six unrelated customer-reported bugs (Exchange Online mailbox rights display, Azure AD group membership sync, AD alert triggering, collector reconnection, Exchange Online API rate-limit handling, and Configuration Wizard load times); the release notes state no new features were added.
  • locked-ioc-18 publishes a security advisory disclosing CVE-2026-28326, a hard-coded static cryptographic key in Access Rights Manager, crediting locked-ioc-21 researcher locked-ioc-20 for discovery and reporting.
  • NVD and OpenCVE record CVE-2026-28326 with CVSS v3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (base score 8.8), CWE-321 classification, and an EPSS score of roughly 0.5% (55th percentile).
  • CVE-2026-28326 is confirmed absent from the CISA Known Exploited Vulnerabilities (KEV) catalog as of this date.
  • The Hacker News publishes coverage of CVE-2026-28326 alongside concurrent locked-ioc-18 Web Help Desk (CVE-2026-28323, CVE-2026-28299) and Serv-U (16 flaws) advisories, noting locked-ioc-18 reports no evidence of in-the-wild exploitation and that no public proof-of-concept exploit exists for CVE-2026-28326.
  • Independent researcher blog Secure in Seconds published an analysis of the hardcoded-key unauthenticated RCE.
  • locked-ioc-19 released the public, non-exploitative locked-ioc-16 detection tool on GitHub, distinguishing vulnerable from patched ARM builds via anonymous gRPC probes.
  • locked-ioc-19 published "Master Key Included: Detecting locked-ioc-18 ARM CVE-2026-28326," detailing the gRPC authentication-bypass and BinaryFormatter/.NET Remoting deserialization chain and confirming exploit development to NT AUTHORITY\SYSTEM by reverse-engineering the diff between vulnerable and patched builds.

Update history

Sources cited for SolarWinds ARM hard-coded key RCE

Drafted by the Threadlinqs research pipeline from 12 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats