CVE-2026-28326

HIGH 8.8

SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability

CVSS Score

8.8

EPSS Score

0.0%

EPSS Percentile

0th

SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.

CWE	CWE-321
Vendor	solarwinds
Product	access rights manager
Published	Sep 17, 2026

Stay Ahead of the Next One

Get instant alerts for solarwinds access rights manager

Be the first to know when new high vulnerabilities affecting solarwinds access rights manager are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

SolarWinds / Access Rights Manager

2026.2 and all previous versions

References

NVD ↗ CVE.org ↗ EPSS Data ↗

solarwinds.com: https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28326 documentation.solarwinds.com: https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/arm_2026-2-1_release_notes.htm documentation.solarwinds.com: https://documentation.solarwinds.com/en/success_center/arm/content/secure-your-arm-deployment.htm

Credits

🔍 Kai Huang from Armadin