SolarWinds has released security updates for Access Rights Manager (ARM), its enterprise tool for auditing and managing user access rights across Active Directory and Windows systems. The headline flaw, CVE-2026-28326 (CVSS 8.8), stems from a hard-coded static key baked into the product. Because the key is the same across all installations, any unauthenticated attacker who can reach ARM’s network port can craft requests that trigger remote code execution — no credentials required. The flaw affects all versions of ARM 2026.2 and earlier; the fix is in ARM 2026.2.1, released September 17, 2026. SolarWinds says the issue was reported by Armadin security researcher Kai Huang and has not been observed being exploited in the wild.
The same advisory batch includes two additional patches for SolarWinds Web Help Desk. The first is a critical SAML authentication bypass (CVE-2026-28323, CVSS 9.8) that allows an unauthenticated attacker to bypass login entirely when SAML 2.0 authentication is enabled — a particularly severe risk for organizations that have federated their helpdesk with SSO. The second is a denial-of-service flaw (CVE-2026-28299, CVSS 8.2) that crashes the WHD server through insufficient memory handling. Both are resolved in WHD 2026.2.1. SolarWinds also patched 16 vulnerabilities across its Serv-U managed file transfer platform (CVE-2026-28302 and CVE-2026-28304 through CVE-2026-28317, CVE-2026-28321, CVE-2026-28323) covering privilege escalation, remote code execution, and unauthorized administrator account creation.
How to check if you’re affected
Affected products are SolarWinds Access Rights Manager versions 2026.2 and earlier, Web Help Desk versions prior to 2026.2.1, and Serv-U products with versions prior to the September 2026 patch release. Log in to your SolarWinds product and check the version number in the About screen. If your ARM deployment runs in an environment accessible from outside your internal network, treat CVE-2026-28326 as urgent — unauthenticated RCE with no in-the-wild exploitation today does not mean the window stays closed for long.