On 17 September 2026, SolarWinds published a security advisory on vulnerability CVE-2026-28326 — a flaw in Access Rights Manager (ARM) that allows arbitrary code execution without authentication. The cause is the use of a hard-coded static cryptographic key. The vulnerability affects ARM version 2026.2 and all earlier releases; a fix is available in ARM 2026.2.1. At the same time, the company closed a critical SAML authentication bypass in Web Help Desk and 16 vulnerabilities in Serv-U — including several that allow code execution as root.
Technical details of CVE-2026-28326
The vendor rates the vulnerability at 8.8 on the CVSS 3.1 scale (High severity). The CVSS vector — AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — highlights several important characteristics:
- Attack vector — adjacent network (AV:A), not the internet. This means the attacker must be in the same network segment as the target ARM instance. The vulnerability is not intended for direct exploitation over the internet, although in environments with a flat network architecture or VPN access, the boundary between an “adjacent network” and “remote access” can blur.
- No privileges (PR:N) or user interaction (UI:N) are required — the attack is fully autonomous once network access is obtained.
- Complete impact on confidentiality, integrity, and availability (C:H/I:H/A:H).
The core of the issue is a hard-coded static key. Such keys are typically used to sign or encrypt tokens, sessions, or inter-component communications. Since the key is identical across all installations of the affected versions, an attacker who knows its value can forge trusted data and achieve arbitrary code execution. According to the vendor, there were no signs of active exploitation at the time the advisory was published; the vulnerability is also absent from the CISA KEV catalog.
Related vulnerabilities: Web Help Desk and Serv-U
Together with the ARM patch, the company fixed vulnerabilities in two other products.
Web Help Desk
In WHD 2026.2.1, the following have been fixed:
- CVE-2026-28323 (CVSS 9.8, Critical) — a SAML authentication bypass. Exploitation is possible only when SAML 2.0 authentication is enabled. This is a significant limitation: organizations that do not use SAML in WHD are not affected by this vulnerability.
- CVE-2026-28299 (CVSS 8.2, High) — a denial-of-service issue caused by insufficient control over memory consumption, leading to a crash of the WHD server.
Serv-U
In Serv-U 2026.3, 16 vulnerabilities have been closed. Among the most serious are:
- CVE-2026-28304 (CVSS 9.1, Critical) — remote arbitrary code execution as root.
- CVE-2026-28302 (CVSS 9.1, Critical) — an IDOR vulnerability leading to privilege escalation and code execution as root; group administrator access is required.
- CVE-2026-28321 (CVSS 9.1, Critical) — an access control violation that allows arbitrary file read and write with subsequent code execution as root; domain administrator access is required.
- CVE-2026-28317 (CVSS 9.1, Critical) — an IDOR vulnerability with privilege escalation; domain administrator access is required.
An important detail for prioritization: many Serv-U vulnerabilities require privileged administrative access (group or domain administrator), which reduces the likelihood of exploitation from outside, but makes them a dangerous tool for lateral movement once an account has already been compromised. Previously, we have already written about a vulnerability in SolarWinds Serv-U confirmed by CISA as actively exploited — the current update package affects the same product.
Prioritization and recommendations
The scope of the update covers three different SolarWinds products with different operating conditions. For effective prioritization, it is worth considering configuration boundaries:
- ARM — high priority. CVE-2026-28326 does not require authentication and affects all versions up to and including 2026.2. Update to ARM 2026.2.1. Additionally, check network segmentation: ARM should not be accessible from user or guest network segments.
- WHD with SAML enabled — critical priority. CVE-2026-28323 has a score of 9.8 and allows authentication bypass. If SAML 2.0 is not used, the vulnerability does not apply, but updating to WHD 2026.2.1 is still recommended to close CVE-2026-28299.
- Serv-U — high priority. Despite the requirement for administrative privileges for several vulnerabilities, the presence of multiple paths to code execution as root (CVE-2026-28304, CVE-2026-28302, CVE-2026-28321) makes updating to Serv-U 2026.3 strongly advisable.
The current SolarWinds update package closes a total of 19 vulnerabilities across three products, several of which have a critical rating of 9.1–9.8. Although active exploitation of CVE-2026-28326 has not been confirmed at this time, the nature of the vulnerability — a hard-coded key that does not require authentication — makes it an attractive target once details are published. Administrators of SolarWinds infrastructure should apply the ARM 2026.2.1, WHD 2026.2.1, and Serv-U 2026.3 updates during the next maintenance window and audit the network exposure of the affected services.
