SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE

SolarWinds released a patch for CVE-2026-28326 — a high-severity (CVSS 8.8) unauthenticated RCE in Access Rights Manager caused by a hard-coded static cryptographic key. The flaw affects ARM versions 2026.2 and earlier and is fixed in 2026.2.1; exploitation requires adjacent-network access. Administrators are advised to upgrade immediately, restrict network access to the ARM host, and review logs; SolarWinds reported no evidence of in-the-wild exploitation at publication.