# SolarWinds Access Rights Manager Hard-Coded Cryptographic Key (CVE-2026-28326) Enables Unauthenticated RCE

> SolarWinds patched CVE-2026-28326 (CVSS 3.1: 8.8), a hard-coded static cryptographic key (CWE-321) in Access Rights Manager (ARM) 2026.2 and prior that lets an unauthenticated attacker on the adjacent network achieve remote code execution. The fix ships in ARM 2026.2.1; SolarWinds reports no evidence of in-the-wild exploitation, no public PoC exists, and the CVE is absent from the CISA KEV catalog.

- **Published:** 2026-09-19T00:00:00Z
- **Last reviewed:** 2026-09-27T15:33:24.472Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2585
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-solarwinds-arm-hard-coded-key-rce-tl-2026-2585.webp?v=d00c9c51 (Threadlinqs threat intel: CVE-2026-28326 SolarWinds ARM RCE: Detection & IOCs (TL-2026-2585) — Critical severity, 27 IOCs, 9 detection rules.)
- **ID:** TL-2026-2585
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 27
- **CVEs:** CVE-2026-28326

## Description

On September 17, 2026, SolarWinds published a security advisory and release notes for Access Rights Manager (ARM) 2026.2.1, fixing CVE-2026-28326, a high-severity (CVSS 3.1: 8.8, vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) vulnerability classified CWE-321 (Use of a Hard-coded Cryptographic Key). ARM is SolarWinds' Active Directory / Exchange / NTFS privileged-access-governance product. Multiple independently corroborating sources (SolarWinds' own advisory, NVD/OpenCVE, and third-party CVE trackers) consistently describe the root cause as a hardcoded static key embedded in the ARM application that permits an unauthenticated attacker to achieve remote code execution; none of the reviewed sources published the precise low-level exploitation mechanic (e.g., whether the key is used to sign, encrypt, or authenticate a message ARM's server subsequently trusts and processes), so that detail should be treated as vendor-undisclosed rather than assumed.

The attack vector is rated Adjacent Network (AV:A) rather than Network (AV:N), consistent with SolarWinds' own ARM deployment guidance, which documents ARM's internal server-to-collector and client communication and recommends ARM run on a dedicated, non-internet-facing server, with ARM and the SolarWinds Platform installed on separate servers. An attacker with reachability to ARM's internal service ports — e.g., from an already-compromised host on the same segment or VLAN — is therefore the realistic exploitation scenario, not a direct internet-facing attack. CVE-2026-28326 was reserved on February 26, 2026, publicly disclosed September 17, 2026, and last updated in NVD/OpenCVE on September 18, 2026. FIRST.org EPSS data available at disclosure time scored the CVE at approximately 0.5% exploitation probability (roughly the 55th percentile of all scored CVEs) — consistent with SolarWinds' statement that it has seen no evidence of in-the-wild exploitation and with the absence of any public proof-of-concept exploit code as of this writing.

This is not the first time SolarWinds ARM has shipped with a hard-coded/static secret exposed in its architecture: in September 2024, SolarWinds patched CVE-2024-28990 (hard-coded RabbitMQ credentials permitting authentication bypass to the ARM RabbitMQ management console, CVSS 6.3) alongside CVE-2024-28991 (an authenticated insecure-deserialization RCE yielding SYSTEM-level code execution, CVSS 9.0 per the vendor / 9.9 per Trend Micro Zero Day Initiative, discovered by Piotr Bazydlo of ZDI) — both fixed together in ARM 2024.3.1. CVE-2026-28326 now represents the same class of weakness (embedded/static secret material undermining ARM's trust boundary) in a fully unauthenticated form, a meaningful regression from the 2024 fixes.

CVE-2026-28326 was disclosed as part of a broader SolarWinds September 2026 security update cycle; the same Hacker News report that surfaced ARM's flaw also references concurrent SolarWinds advisories affecting Web Help Desk (CVE-2026-28323, CVE-2026-28299) and 16 flaws across Serv-U (CVE-2026-28302, CVE-2026-28304 through CVE-2026-28317, CVE-2026-28321, CVE-2026-28323). Independent research corroborates that CVE-2026-28323 is a SAML 2.0 authentication-bypass flaw in Web Help Desk (a forged/relayed SAMLResponse to the SAML Assertion Consumer Service endpoint establishes a session without valid credentials) and that CVE-2026-28299 is an unauthenticated denial-of-service flaw in the same product; both were fixed in WHD 2026.2.1. These are separate CVEs in separate SolarWinds products from CVE-2026-28326 and are not themselves mapped into this threat's MITRE/IOC data, but they establish that SolarWinds' privileged-IT-management product line underwent a coordinated multi-product patch cycle in mid-to-late 2026, and that at least one sibling flaw in that cycle (CVE-2026-28318, a Serv-U unauthenticated DoS disclosed in June 2026) was subsequently added to the CISA Known Exploited Vulnerabilities catalog — underscoring that SolarWinds privileged-access and IT-management tooling has been an active target class in 2026, even though CVE-2026-28326 itself carries no confirmed-exploitation evidence.

No technical writeup or proof-of-concept exploit code from discoverer Kai Huang (Armadin) or any third party has been identified as of this writing, and CVE-2026-28326 does not appear in the CISA KEV catalog. Impact is nonetheless rated CRITICAL because of what ARM manages: successful RCE against the ARM server (which SolarWinds documentation indicates runs with SYSTEM-level privileges) would hand an attacker code execution on the system that holds delegated rights to provision, audit, and modify Active Directory, Exchange, and NTFS file-share access — a direct path to account manipulation, AD permission-group discovery, and collection of locally stored access-governance data, independent of whether the attacker pivots further.

## MITRE ATT&CK

- T1059 Command and Scripting Interpreter
- T1552 Unsecured Credentials
- T1543 Create or Modify System Process
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1098 Account Manipulation
- T1484 Domain or Tenant Policy Modification
- T1005 Data from Local System
- T1595.002 Active Scanning: Vulnerability Scanning
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1587.004 Develop Capabilities: Exploits
- T1190 Exploit Public-Facing Application
- T1210 Exploitation of Remote Services
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Defense Evasion
- T1552.001 Unsecured Credentials: Credentials In Files
- T1046 Network Service Discovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**New Service, Scheduled Task, or GPO Change on SolarWinds ARM Host — Post-Exploitation Persistence/Priv-Esc** (`TL-2026-2585-SPL-002`)

Detects creation of a new Windows service (4697), a new scheduled task (4698), or a Group Policy object attribute change (5136) on a host identified as a SolarWinds Access Rights Manager server. Because ARM's server component runs with SYSTEM-level privileges (per SolarWinds documentation), a successful CVE-2026-28326 RCE hands an attacker a foothold from which persistence (new service/task) and domain-tier privilege escalation (GPO/domain policy modification, account manipulation) are the expected next steps.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1543, T1068, T1098, T1484
- **Data sources:** windows_security, sysmon
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=wineventlog sourcetype="WinEventLog:Security" (EventCode=4697 OR EventCode=4698 OR EventCode=5136)
| where match(host, "(?i)(ARM|ACCESSRIGHTS)") OR match(ServiceFileName, "(?i)ARM") OR EventCode=5136
| eval risk_reason="New service/scheduled task or Group Policy object change on/near SolarWinds ARM host - possible post-exploitation persistence or privilege escalation for CVE-2026-28326"
| table _time, host, EventCode, ServiceName, ServiceFileName, TaskName, ObjectDN, AttributeLDAPDisplayName, SubjectUserName, SubjectUserSid
| sort -_time
```

### Microsoft KQL

```kql
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID in (4697, 4698, 5136)
| where Computer has_any ("ARM","ACCESSRIGHTS") or EventID == 5136
| project TimeGenerated, Computer, EventID, Activity, SubjectAccount, ObjectDN=extractjson('$.ObjectDN', tostring(EventData)), ServiceFileName=extractjson('$.ServiceFileName', tostring(EventData))
| order by TimeGenerated desc
```

### Sigma

```yaml
title: New Service, Scheduled Task, or GPO Change on SolarWinds ARM Host (Post-Exploitation Persistence)
id: 3d4e5f6a-7b8c-4d9e-a0f1-2b3c4d5e6f7a
status: experimental
description: Detects creation of a new Windows service, scheduled task, or Group Policy object attribute change on a host identified as a SolarWinds Access Rights Manager server, consistent with post-exploitation persistence and domain-tier privilege escalation following CVE-2026-28326 RCE.
references:
  - https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28326
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-19
tags:
  - attack.persistence
  - attack.t1543
  - attack.privilege-escalation
  - attack.t1068
  - attack.t1098
  - attack.t1484
  - cve.2026.28326
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4697
      - 4698
      - 5136
  filter_host:
    Computer|contains:
      - 'ARM'
      - 'ACCESSRIGHTS'
  condition: selection and filter_host
falsepositives:
  - Legitimate ARM software update installing a Windows service
  - Scheduled maintenance tasks or approved GPO change-control activity performed by authorized administrators
level: high
```

**Known false positives:**

- Legitimate ARM software update installing a Windows service
- Scheduled maintenance tasks or approved GPO change-control activity performed by authorized administrators

**Tuning notes:** Restrict the host filter to your actual ARM server hostname/OU rather than a broad substring match, and cross-reference SubjectUserSid/SubjectAccount against your ARM service-account and change-management allowlist to suppress approved maintenance.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SolarWinds ARM Service Spawning Command Interpreter — CVE-2026-28326 Exploitation Indicator (locked: unlock with TL Creds)
- New Service, Scheduled Task, or GPO Change on SolarWinds ARM Host — Post-Exploitation Persistence/Priv-Esc (locked: unlock with TL Creds)
- AD Enumeration and Access-Governance Data Staging from SolarWinds ARM Host — Collection/Lateral Prep (locked: unlock with TL Creds)
- SolarWinds ARM Service Spawning Command Interpreter — CVE-2026-28326 Exploitation Indicator (locked: unlock with TL Creds)
- New Service, Scheduled Task, or GPO Change on SolarWinds ARM Host — Post-Exploitation Persistence/Priv-Esc (locked: unlock with TL Creds)
- AD Enumeration and Access-Governance Data Staging from SolarWinds ARM Host — Collection/Lateral Prep (locked: unlock with TL Creds)
- SolarWinds ARM Service Spawning Command Interpreter — CVE-2026-28326 Exploitation Indicator (locked: unlock with TL Creds)
- AD Enumeration and Access-Governance Data Staging from SolarWinds ARM Host — Collection/Lateral Prep (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE](https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html)
- [SolarWinds Security Advisory: CVE-2026-28326](https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28326)
- [NVD - CVE-2026-28326 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-28326)
- [CVE-2026-28326 - Vulnerability Details](https://app.opencve.io/cve/CVE-2026-28326)
- [SolarWinds Access Rights Manager 2026.2.1 Release Notes](https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2026-2-1_release_notes.htm)
- [Secure Your ARM Deployment](https://documentation.solarwinds.com/en/success_center/arm/content/secure-your-arm-deployment.htm)
- [CVE-2026-28326: CWE-321 Use of Hard-coded Cryptographic Key in SolarWinds Access Rights Manager](https://radar.offseq.com/threat/cve-2026-28326-cwe-321-use-of-hard-coded-cryptographic-key-in-solarwinds-access-rights-manager-18f36d8df851236d)
- [CVE-2026-28326 Vulnerability Analysis](https://www.strix.ai/cve/CVE-2026-28326)
- [Recommendations for CVE-2026-28323 and CVE-2026-28299](https://arcticwolf.com/resources/blog/cve-2026-28323-and-cve-2026-28299/)
- [SolarWinds Fixed Critical RCE CVE-2024-28991 in Access Rights Manager](https://securityaffairs.com/168456/security/solarwinds-fixed-rce-cve-2024-28991.html)
- [SolarWinds Issues Patch for Critical ARM Vulnerability Enabling RCE Attacks](https://thehackernews.com/2024/09/solarwinds-issues-patch-for-critical.html)
- [SolarWinds Patches Critical Vulnerability in Access Rights Manager (CVE-2024-28990/CVE-2024-28991 precedent coverage)](https://www.securityweek.com/solarwinds-patches-critical-vulnerability-in-access-rights-manager/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2585