Loading vulnerability…
Unauthenticated Remote Code Execution in SolarWinds Access Rights Manager
CVE-2026-28326 is an unauthenticated remote code execution vulnerability affecting SolarWinds Access Rights Manager (ARM) 2026.2 and earlier, including build 2026.2.0.42. The ARM gRPC service uses a hardcoded, product-wide HMAC key in a fallback authentication mechanism intended for local child processes. The mechanism does not enforce local-only access, allowing remote callers without client certificates to forge authentication tokens and assume a registered client's identity. Authenticated requests can subsequently reach .NET BinaryFormatter deserialization protected by an insufficient type denylist, enabling arbitrary code execution. ARM runs as LocalSystem by default. The vulnerability has a vendor-assigned CVSS v3.1 score of 8.8.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can completely compromise the ARM server, with high impacts to confidentiality, integrity, and availability. Code execution occurs with LocalSystem privileges in default deployments. Because ARM can hold delegated privileges over Active Directory, file servers, Exchange, and SharePoint, compromise can also expose managed resources and enable further unauthorized access, depending on the deployment's permissions.
If you can’t patch tonight, do this now.
Restrict inbound TCP port 55555 to explicitly required ARM components and trusted administration hosts, covering both IPv4 and IPv6. Segment ARM servers from untrusted and broadly accessible internal networks. TLS alone does not prevent exploitation because vulnerable deployments request, but do not require, client certificates. Review firewall exposure and suspicious connections; preserve relevant volatile connection evidence before restarting where incident investigation is warranted. These controls reduce exposure but do not replace patching.
Patch, then assume compromise.
Upgrade to SolarWinds Access Rights Manager 2026.2.1, ensuring the installed build is 2026.2.1.7 or later. The correction removes the vulnerable remote fallback authentication mechanism, restricts certificate-less access to localhost using a fresh per-start token, and strengthens deserialization filtering with an allowlist. Upgrade unsupported installations to a supported, corrected release rather than relying on updates for end-of-life versions.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
43 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.