SolarWinds Access Rights Manager hard coded key enables unauthenticated remote code execution

SolarWinds patched a high-severity flaw in Access Rights Manager, tracked as CVE-2026-28326 and rated 8.8, that stems from a hard-coded static key and can lead to unauthenticated remote code execution. The issue affects all Access Rights Manager 2026.2 and prior releases and is fixed in 2026.2.1. SolarWinds credited Armadin researcher Kai Huang and reported no evidence of exploitation in the wild. The advisory arrives alongside separate fixes: a Web Help Desk SAML authentication bypass, a Web Help Desk denial-of-service issue, and sixteen Serv-U flaws that could allow privilege escalation, code execution, and creation of administrator accounts.

Check

Inventory SolarWinds Access Rights Manager instances, confirm versions at or below 2026.2, and upgrade to 2026.2.1 on an emergency schedule.

Affected

Access Rights Manager 2026.2 and earlier ship a hard-coded static key that an unauthenticated attacker can use to reach remote code execution.

Fix

Patch to 2026.2.1, restrict management interfaces to trusted networks, and separately update Web Help Desk and Serv-U to their fixed builds.