Exploitation observed; activity peaked at 14 mentions and remains active
Immediate actions
Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Recommended action window: Immediate (within 24h)
NVD description
SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.
🚨 A hard-coded static key in SolarWinds ARM can enable unauthenticated RCE.
CVE-2026-28326 affects ARM 2026.2 and earlier and is fixed in 2026.2.1. SolarWinds did not report in-the-wild exploitation.
Read: https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html
Post summary
The tweet discloses CVE-2026-28326 in SolarWinds ARM, detailing a hard-coded static key enabling unauthenticated RCE, confirming the fix in 2026.2.1, and explicitly stating no in-the-wild exploitation was reported.
Our Senior Capability Researcher @mhskai2017 found three unauthenticated RCEs across the SolarWinds product line, none requiring user interaction.
In Access Rights Manager (ARM), CVE-2026-28326, a hard-coded installer secret defeated the mTLS gate, and a single connection could execute code as the ARM service principal, which is Domain-Admin-equivalent. All versions were affected.
In Web Performance Monitor (WPM), CVE-2026-28324, the default passive Player never ran its auth check. Past that, the integrity check compared attacker input against a hash of attacker input, and the signature check accepted any binary whose signer subject contained "SolarWinds." The update endpoint became a SYSTEM launcher.
And in the Orion core, CVE-2026-28325, a single crafted WebSocket frame with an empty clientId bypassed the certificate check and reached a binder-free http://Json.NET deserializer as SYSTEM, on a default install with no add-on modules.
We reported all three to SolarWinds, and each has since been patched (2026.2.3 for WPM and the Orion core). We waited two weeks after the last fix before publishing so customers had time to update.
Kai walks through each one in a new three-part series.
Start with Part 1 here: https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-access-rights-manager-responsible-disclosure-part-1
Part 2: https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-web-performance-monitor-responsible-disclosure-part-2
Part 3: https://www.armadin.com/blog-posts/unauthenticated-rce-in-solarwinds-core-responsible-disclosure-part-3
Post summary
The text announces three unauthenticated RCE vulnerabilities (CVE-2026-28326, -28324, -28325) in SolarWinds products, discloses their root causes, and states that patches were released as version 2026.2.3 following responsible disclosure to the vendor.
SolarWinds ARM hardcoded-key RCE is patched!!
CVE-2026-28326 (CVSS 8.8): unauthenticated remote code execution in Access Rights Manager via a hard-coded static key. Affects 2026.2 and earlier. Fixed in 2026.2.1. Credited to Kai Huang (Armadin).
https://0daynews.com/articles/2026-09-20-solarwinds-arm-cve-2026-28326-hardcoded-key-rce/
#Cybersecurity#AI#AISecurity#MCP#Claude#GPT#Infosec#Trending#RCE#IdentitySecurity
Post summary
The text discloses CVE-2026-28326, a high-severity unauthenticated RCE in SolarWinds Access Rights Manager caused by a hardcoded static key, and confirms it has been patched in version 2026.2.1, with no mention of active exploitation or available PoC/exploit tools.
The master key came with the software.
CVE-2026-28326: SolarWinds ARM shipped with a shared authentication secret that enabled unauthenticated RCE.
Jon Williams & Bishop Fox TEA team confirmed SYSTEM access.
CVSS: 8.8 or 9.8, depending on exposure. https://t.co/syMvIHLtu2
Post summary
The text describes CVE-2026-28326 as an unauthenticated RCE caused by a shared authentication secret in SolarWinds ARM and reports researcher-confirmed SYSTEM access. It provides technical details and CVSS scores, but no PoC, active exploitation report, or remediation.
A hardcoded key in SolarWinds Access Rights Manager opens the door to unauthenticated RCE (CVSS 8.8).
CVE-2026-28326 stems from a static cryptographic key baked into the product, letting an attacker with no credentials execute arbitrary code remotely.
Affects ARM 2026.2 and all prior versions. Fixed in ARM 2026.2.1. Update now.
Details: http://vulntracker.io/cves/CVE-2026-28326
#SolarWinds#CVE#InfoSec#CyberSecurity#AccessRightsManager
Post summary
The text discloses CVE-2026-28326, a hardcoded key vulnerability enabling unauthenticated RCE (CVSS 8.8) in SolarWinds Access Rights Manager, and explicitly urges users to update to ARM 2026.2.1 for the fix.
🚨 #ALERT A hard-coded static key in SolarWinds ARM can enable unauthenticated RCE.
CVE-2026-28326 affects ARM 2026.2 and earlier and is fixed in 2026.2.1. SolarWinds did not report in-the-wild exploitation.
#cybersecurity
Read: https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html https://t.co/a5EI5D1syB
Post summary
The tweet alerts about CVE‑2026‑28326, a hard‑coded static key in SolarWinds ARM leading to unauthenticated RCE, affecting versions up to 2026.2, and notes the issue is patched in version 2026.2.1 with no reported in‑the‑wild exploitation.
🚨 SOLARWINDS PATCHES UNAUTHENTICATED ACCESS RIGHTS MANAGER RCE
SolarWinds has fixed CVE-2026-28326, a high-severity unauthenticated remote code execution vulnerability affecting Access Rights Manager.
SolarWinds says the vulnerability stems from a hardcoded static key and is fixed in ARM 2026.2.1.
There is currently no confirmed evidence of active exploitation.
⚠️ Analyst Note:
Identity and access-management infrastructure is a valuable target because compromise can expose privileged relationships and enterprise access paths. Organizations running affected ARM deployments should prioritize the update even without confirmed exploitation.
Official SolarWinds release notes:
https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2026-2-1_release_notes.htm
#CyberSecurity#Vulnerability#SolarWinds#ThreatIntel#DDW#DarkWeb
Post summary
The text announces that SolarWinds has patched a high-severity unauthenticated RCE vulnerability in Access Rights Manager (CVE-2026-28326) with the release of version 2026.2.1, recommending organizations apply the fix despite no evidence of active exploitation.
Warning: #SolarWinds has released security updates for hard-coded static key vulnerability in Access Rights Manager. CVE-2026-28326 CVSS:8.8. Successful exploitation enables unauthenticated attacker to execute remote code, potentially compromising the system. #Patch#Patch#Patch
Post summary
SolarWinds released security updates for CVE-2026-28326 (CVSS 8.8), a hard-coded static key vulnerability in Access Rights Manager enabling unauthenticated remote code execution.
🔒 CYBERSECURITY, PRIVACY & OPEN SOURCE ROUNDUP — September 19, 2026
1️⃣ DOCKER HYPERVISOR ESCAPE: THREE LINES OF BASH UNLOCK THE HOST FILESYSTEM
A container that is supposed to be locked away just got full read and write access to the machine running it. In CVE-2026-77179, Docker's virtual machine monitor relies on virtio-fs, and the file server runs on the host side. Because of a time-of-check-to-time-of-use flaw, a container can open a file, delete it while still holding the handle, and replace the parent folder with a symlink — the kernel then follows that link to anywhere on the host. The whole chain takes three lines of bash, and the researcher published a full technical breakdown of the escape.
🔹 @orenyomtov
2️⃣ GOOGLE PIXEL MODEM ZERO-DAY IS BEING EXPLOITED IN THE WILD
Google confirmed that a zero-click vulnerability in the Pixel cellular modem is already being used in limited, targeted attacks. A logic error lets an attacker bypass permission checks and gain elevated access on the device, with one constraint: the attacker needs to be physically nearby. The September security update (patch level 2026-09-05 or later) fixes CVE-2026-58704, and CISA has added it to its Known Exploited Vulnerabilities catalog.
🔹 @IntCyberDigest
3️⃣ N8N GETS A CVSS 10.0 PUBLIC EXPLOIT
The popular open-source workflow automation tool n8n just received a fully weaponized vulnerability: CVE-2026-21858, nicknamed "Ni8mare," scores a perfect 10.0. It starts with an unauthenticated file read and escalates to full remote code execution, and a working proof of concept is already circulating. Any internet-facing n8n instance that missed the patch is one request away from being fully compromised.
🔹 @PadhiyarRushi
4️⃣ BREVO SUPPLY-CHAIN ATTACK REACHES OVER 100,000 WEBSITES
A supply-chain attack against the Brevo email platform may have affected more than 100,000 websites through infrastructure they already trusted. Attackers used a compromised Cloudflare API key to deploy a malicious worker that modified Brevo-hosted scripts at the edge: visitors were shown fake "prove you're human" click-fix prompts, while logged-in WordPress admins could have a malicious plugin installed through their active session. Brevo's origin files stayed clean, which makes the attack even harder to spot.
🔹 @Huntio
5️⃣ SOLARWINDS ARM: A HARD-CODED KEY OPENS THE DOOR TO REMOTE CODE EXECUTION
SolarWinds disclosed a hard-coded static key in its Application Resource Management product that can be abused for unauthenticated remote code execution. CVE-2026-28326 affects ARM 2026.2 and earlier, and is fixed in 2026.2.1. The company did not report any in-the-wild exploitation, but a static key of this kind is exactly the sort of thing scanners look for.
🔹 @TheHackersNews
6️⃣ PUBLIC CVE DISCLOSURES ARE ACCELERATING AT A TERRIFYING PACE
A data point worth pausing on: tallying publicly disclosed CVEs month by month, the recent trend looks alarming — and the global surge in vulnerability hunting activity suggests this is only the beginning. The researcher behind the analysis expects the numbers to jump by an order of magnitude in the coming months, which means patching cadence and exposure reduction are no longer optional hygiene.
🔹 @nekono_naha
7️⃣ UBUNTU 26.10 MOVES TO THE LINUX 7.3 KERNEL
Ubuntu 26.10, the latest interim release of the always-changing flavor, is shipping with the Linux 7.3 kernel. For people who track where the desktop distribution stands, it marks another step in Ubuntu's steady climb toward the newest mainline kernel features.
🔹 @phoronix
8️⃣ IPHONE LOCKDOWN MODE JUST BEAT AN FBI EXTRACTION ATTEMPT
Apple's Lockdown Mode is having a moment: the FBI said it was unable to extract data from a journalist's iPhone because the device had Lockdown Mode enabled. The setting is not a magic shield, but it drastically shrinks the attack surface by restricting features that sophisticated attacks rely on, from certain attachments and FaceTime requests to configuration profiles and untrusted wireless connections.
🔹 @cyber_razz
💭 The common thread this week is that every boundary we assumed was solid turned out to have a door: a container "wall" that a symlink walks through, a modem that gets hit with zero clicks before the phone is even unlocked, an email platform trusted by 100,000 sites that was bent through a single API key. The lesson is not to panic — it is to treat isolation, patching cadence, and least privilege as the actual product, because in 2026 the trust you assume is the thing that gets exploited.
Which of these hits closest to home — containerized servers, the phone in your pocket, or a website you help run? Tell me below 👇
#CyberSecurity#OpenSource#Privacy
Post summary
The roundup highlights multiple critical CVEs, including one explicitly reported as actively exploited in the wild (CVE-2026-58704) with patches and PoCs noted, making active exploitation the dominant theme.
Master Key Included: Detecting SolarWinds ARM CVE-2026-28326
https://bishopfox.com/blog/detecting-solarwinds-arm-cve-2026-28326
Post summary
The text mentions a CVE for SolarWinds ARM but provides no additional details on PoC, exploitation, patches, or technical specifics. The classification is General due to insufficient indicators for other categories.
Attackers exploited CVE-2026-28326 in SolarWinds ARM using a hardcoded authentication key to achieve unauthenticated RCE as NT AUTHORITY\SYSTEM. The compromised identity governance platform then enabled privilege escalation and lateral movement across Active Directory and file servers. Runtime segmentation helps contain such post-compromise pivoting. #IdentitySecurity#ZeroTrust
🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/solarwinds-arm-cve-2026-28326-unauthenticated-rce
Post summary
The text reports that CVE-2026-28326 in SolarWinds ARM is being actively exploited in the wild via a hardcoded authentication key to achieve unauthenticated RCE and facilitate lateral movement, linking to a detailed threat research analysis.
View the CVE listing here: https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28326
Post summary
The post shares a link to the official SolarWinds security advisory for CVE-2026-28326, serving as a notification of the vulnerability's existence without providing exploitation details, PoC, or patching instructions.
CVE-2026-28326 is an unauthenticated RCE in SolarWinds Access Rights Manager, CVSS 8.8 (adjacent) to 9.8 (flat network), confirmed NT AUTHORITY\SYSTEM execution, patched in build 2026.2.1.7.
- The root cause is a hardcoded shared HMAC secret shipped in the installer, identical across every deployment. ARM's gRPC listener on TCP 55555 accepts a fallback authentication path: present no client certificate, compute an HMAC token from the static key over attacker-controlled request fields, and the gate passes. The key is recoverable by anyone who can download the product. No nonce, no challenge, no binding to the channel. A valid token is mintable offline without touching the server.
- TLS on port 55555 does not close this. ARM configures the listener to request a client certificate and verify it if presented, but not to require one. A caller presenting nothing completes the TLS handshake anonymously, lands unauthenticated, and faces only the application-layer HMAC check as the sole control. The difference between "request" and "require" is one enum value in the configuration call. Any service described as mutual-TLS protected warrants the same verification.
- Past the gate, the connection reaches a BinaryFormatter deserialization sink carrying .NET Remoting traffic. The only protection was a denylist of 27 regex patterns over known gadget type names, applied to an unbounded type space. Bishop Fox built a working exploit chain against an unpatched lab server and confirmed command execution as NT AUTHORITY\SYSTEM via an out-of-band HTTP callback and a dropped file. Builds 2026.2.0.42 and earlier are affected.
- The firewall posture governs real-world CVSS. ARM's Windows Firewall rule for 55555 ships disabled and scoped to 127.0.0.1, but SolarWinds' own prerequisites instruct administrators to open it inbound so collectors can reach the server. On any working multi-host deployment the port is open. ARM console operators (ordinary admin workstations) are inside that allowlist. A flat or permissive internal network elevates the effective score to 9.8 AV:N. Read the actual firewall rule; do not inherit the vendor's adjacency assumption.
- Before patching, look for evidence of prior use. The GrantMA service exposes GET /api/armconfig/network/Connections: a record showing IsAuthenticated: false paired with a populated ClientCertThumbPrint is the signature the vulnerable fallback path produces and a legitimate client login does not. This list is memory-only and purges entries after three days, so query it before the service restart that applies the patch wipes it. The patch rewrites the gate entirely, replacing the HMAC fallback with a localhost-only check tied to a per-process random GUID, so patching removes the path rather than hardening it.
Takeaway: patch to 2026.2.1.7, query the connection list now before you restart the service, then read the actual firewall rule governing 55555 and treat a permissive rule as a separate exposure finding. Bishop Fox's detection tool (available on GitHub as CVE-2026-28326-check) fingerprints patch state from outside using two anonymous gRPC probes: a vulnerable build returns gRPC status 14 UNAVAILABLE on the Remoting/Send call, while a patched build returns gRPC status 16 UNAUTHENTICATED with the message "Client certificate not found. Please register your application first." An inconclusive result is not a clean one.
#DFIR_Radar
Post summary
The text provides a deep technical analysis of CVE-2026-28326, an unauthenticated RCE in SolarWinds Access Rights Manager, and strongly advises patching to version 2026.2.1.7 while performing forensic log checks before service restart.
SolarWinds Access Rights Managerに認証なしRCE（CVE-2026-28326、CVSS 8.8）。原因はハードコードされたキーで、2026.2以前が対象、修正は2026.2.1。発見はArmadinのKai Huang。社内のアクセス権棚卸し製品が埋め込み鍵一つで外部からコード実行を許す構図は、権限管理ツール自身が攻撃面になっていることを示す。悪用は未報告。SolaWindsといえば、6年前にサプライチェーン攻撃を広く世界に知らしめた事件の発端。FireEyeがハッキングされたことで話題になった。
Post summary
CVE-2026-28326 is an authentication-bypass RCE in SolarWinds Access Rights Manager caused by a hardcoded key (CVSS 8.8), affecting versions before 2026.2, with a fix released in version 2026.2.1; exploitation is currently unreported.
SolarWinds patched CVE-2026-28326 in Access Rights Manager, fixing a hard-coded key flaw that could allow unauthenticated RCE across version 20. Also addressed serious issues in Web Help Desk and Serv-U. #SolarWinds#ARM#RCE
https://www.hendryadrian.com/solarwinds-patches-arm-hard-coded-key-flaw-enabling-unauthenticated-rce/
Post summary
SolarWinds patched CVE-2026-28326 in Access Rights Manager for a hard-coded key flaw enabling unauthenticated RCE in v20, along with fixes for Web Help Desk and Serv-U.
CVE-2026-28326 (CVSS 8.8) affects SolarWinds Access Rights Manager. Review deployments and apply updates. https://nvd.nist.gov/vuln/detail/CVE-2026-28326 https://adkcyber.com
via NVD Recent High CVSS
#CyberSecurity#InfoSec#Vulnerability#AI#MachineLearning https://t.co/SYFxFPffPQ
Post summary
Announces CVE-2026-28326 (CVSS 8.8) affecting SolarWinds Access Rights Manager, provides technical context via the NVD link, and recommends reviewing deployments and applying updates; no PoC, exploit tool, or active exploitation is mentioned.
The provided text only includes a source link to a Bishop Fox blog post about detecting SolarWinds ARM CVE-2026-28326, without any additional details about PoC, exploit, patches, or active exploitation.
The post discloses an unauthenticated RCE vulnerability in SolarWinds Access Rights Manager (CVE-2026-28326) and announces the release of a fixed version 2026.2.1.
SolarWinds Access Rights Manager hard-coded key enables unauthenticated RCE (CVE-2026-28326) — SolarWinds released ARM 2026.2.1 to fix CVE-2026-28326 (CVSS 8.
#CyberSecurity#InfoSec
https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html
Post summary
The text reports on CVE-2026-28326, an unauthenticated RCE vulnerability in SolarWinds Access Rights Manager, and highlights the release of SolarWinds ARM 2026.2.1 as a patch to resolve the issue.
SolarWinds, Access Rights Manager Yazılımında Sabit Kodlanmış Bir Anahtardan Kaynaklanan Kritik Bir RCE Açığını Kapattı!
SolarWinds Access Rights Manager'daki (ARM) CVE-2026-28326 (CVSS 8.8), yazılımda sabit kodlanmış statik bir anahtarın bulunmasından kaynaklanıyor ve kimlik doğrulaması olmayan bir saldırganın uzaktan kod çalıştırmasına izin veriyor; açık ARM 2026.2 ve öncesi sürümleri etkiliyor, 2026.2.1'de düzeltildi.
• Aynı güncelleme paketinde SolarWinds Web Help Desk'teki SAML kimlik doğrulama atlatma açığı (CVSS 9.8) ve bir hizmet dışı bırakma (DoS) açığı da kapatıldı.
• Şirket, henüz aktif istismara dair bir kanıt bulunmadığını belirtti; açığı Armadin araştırmacısı Kai Huang keşfetti.
2020'deki tedarik zinciri saldırısıyla anılan SolarWinds'in yazılımında yıllar sonra yine sabit kodlanmış bir sırdan kaynaklanan kritik bir açığın bulunması, geçmişte büyük bir güvenlik krizi yaşamış şirketlerin bile temel güvenli kodlama hatalarına karşı bağışık olmadığını gösteriyor.
#SiberGüvenlik#SolarWinds#KritikAçık
Post summary
The announcement describes a critical RCE vulnerability in SolarWinds Access Rights Manager, noting it was fixed in version 2026.2.1, and provides technical details such as the root cause and CVSS score.
