Critical CVE-2026-28326 Vulnerability in SolarWinds Access Rights Manager

• •CVE-2026-28326 allows unauthenticated remote code execution via a hardcoded key.
• •Organizations with broad connectivity and internet exposure are most vulnerable.
• •A patch (version 2026.2.1) is available; urgent upgrade is recommended.

SolarWinds Access Rights Manager has been identified with a high-risk unauthenticated remote code execution vulnerability (CVE-2026-28326) due to a hardcoded static key. This vulnerability allows attackers with adjacent network access to exploit the system without needing credentials or user interaction. Successful exploitation could lead to control over the management server, allowing for theft or manipulation of sensitive information, including privileged accounts. Organizations with broad connectivity, especially those exposing the service to the internet or poorly segmented networks, are particularly at risk. The vulnerability was published on September 17, 2026, and a fixed version (2026.2.1) is available. Immediate action is recommended to mitigate potential risks, including restricting access and upgrading to the patched version.