CVE-2026-28326

Executive Summary

CVE-2026-28326 is an unauthenticated remote code execution vulnerability in SolarWinds Access Rights Manager (ARM), stemming from the use of a hardcoded static cryptographic key (CWE-321). The flaw carries a CVSS v3.1 base score of 8.8 (High) and is exploitable over an adjacent network segment without authentication or user interaction. Successful exploitation grants full compromise of confidentiality, integrity, and availability on the affected host, making ARM deployments a high-value target for lateral movement and credential-access operations in enterprise environments.

Technical Analysis

The advisory data attributes the root cause to a hardcoded static key — classified under CWE-321 (Use of Hard-coded Cryptographic Key). No vendor advisory, NVD CNA title, function names, file paths, parameters, or endpoints are provided in the supplied intelligence. The analysis below is therefore constrained to the vulnerability class and mechanism implied by the CWE and the NVD description text; no implementation-specific artifacts are asserted.

Vulnerability class — CWE-321 (Use of Hard-coded Cryptographic Key): A hardcoded cryptographic key is a secret embedded directly in application source code, binaries, configuration artifacts, or installer packages. Because it is static and identical across every installation, it cannot be rotated, revoked, or uniquely scoped to a deployment. Any actor who extracts the key — via binary reverse engineering, public source disclosure, firmware unpacking, or decompilation of a shipped assembly — obtains a credential that is valid against every vulnerable instance of the product.

Attack surface and mechanism of RCE: SolarWinds Access Rights Manager is a privileged access management platform that brokers, audits, and reports on directory permissions and access rights. Such platforms routinely handle sensitive credential material, service-account secrets, and administrative delegation workflows — which necessarily involve cryptographic operations (encrypted configuration blobs, session tokens, serialized data envelopes, signed update or API payloads). Where the key protecting one of these mechanisms is static:

1. The protection is forgeable — an attacker who knows the key can produce arbitrary ciphertext/messages that the application will decrypt, verify, and trust as legitimate.
2. If a forged artifact is subsequently deserialized, executed, or used to establish an authenticated channel, the standard path from "trusted input" to "code execution" is opened.
3. Because the key is not deployment-scoped, a single key-recovery event compromises the entire install base of the vulnerable release — not just one customer.

The NVD description explicitly states the vulnerability is unauthenticated and results in remote code execution, confirming that the static key gates a pre-authentication code path. The exact gated mechanism (encrypted transport, token generation, payload signature, or serialized object protection) is not disclosed in the supplied data and is therefore not asserted here.

Preconditions: Attack vector is Adjacent (AV:A) per CVSS, meaning the attacker must be positioned on the same logical network segment, adjacent broadcast domain, or routed enclave as the ARM host — this is typical for both on-premises internal attackers and post-initial-access operations. No privileges (PR:N) and no user interaction (UI:N) are required.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code was identified for this CVE. The attack chain below is inferred strictly from the vulnerability class (CWE-321) and the NVD description; no vendor-specific function names, endpoints, or parameters are known or invented.

1) Reconnaissance / target identification An adversary with or seeking a foothold on an adjacent network segment enumerates internal hosts for SolarWinds Access Rights Manager services — via port scanning of the deployment's management/listener ports, service fingerprinting of HTTPS/TLS banners, or passive discovery of ARM-related hostnames and certificate subjects. Shodan Internet-facing exposure is likely low (AV:A), so discovery focuses on internal scanning, LDAP/AD-integrated service enumeration, or pivot from a compromised workstation in the same enclave.

2) Triggering the flaw class The attacker requires the hardcoded static key. Because it is static and shipped with the product, it is recoverable by static analysis of ARM binaries, installer artifacts, or configuration files, or via public disclosure of the key material. With the key in hand, the attacker crafts a request or artifact that the ARM service will process as trusted — the defining exploitation primitive of CWE-321: the attacker can forge, decrypt, or authenticate arbitrary content because the secret is neither secret nor unique.

3) Payload / execution (vulnerability-class level) The forged, key-protected content is submitted to the reachable, pre-authentication ARM listener. Because the application trusts anything protected by the static key, the payload is accepted without authentication and reaches a code-execution sink behind that trust boundary (per the NVD description: unauthenticated remote code execution). Session-creation, deserialization, or encrypted-payload handling are the common classes of sink for CWE-321–derived RCE, but the specific sink for this CVE is not disclosed and is not speculated here. Execution occurs with the privileges of the ARM service account.

4) Post-exploitation impact The CVSS impact subscores are uniformly High (C:H/I:H/A:H), indicating loss of confidentiality, integrity, and availability. Given ARM's role as a privileged access management platform, the executing process is likely to hold or be able to obtain directory credentials, service accounts, and access-audit data. Realistic post-exploitation objectives: credential theft for lateral movement, tampering with access-rights records to conceal unauthorized entitlements, deployment of secondary payloads, and persistence within a high-trust management tier. The AV:A vector places this squarely in a lateral-movement / internal-pivot kill chain.

Impact Assessment

• Base score: 8.8 (High) — CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Exploitability: Adjacent attack vector, low complexity, no privileges, no user interaction — highly favorable to an attacker already inside the network perimeter.
• Impact: High across C/I/H. Full loss of confidentiality (exfiltration of managed credentials and access data), integrity (forging trust decisions, manipulating access-rights records), and availability (service disruption or host takeover).
• Scope: Unchanged (S:U) — impact remains within the ARM host's security authority, though the data it manages is organization-wide.
• Blast radius: Every deployment of the affected ARM release is at risk because the key is static — one leaked key equals universal exposure. Because ARM is a privileged access management product, a compromise can cascade into Active Directory / directory-wide compromise, making effective blast radius substantially larger than a single host.
• EPSS: Not yet scored by FIRST.org — no exploitation-probability estimate is available.
• CISA KEV: Not listed — no confirmed exploitation in the wild as of this report.
• Exploit availability: None public (no PoC, no Nuclei template, no exploit code identified).

Detection Guidance

Detection is constrained by the absence of disclosed endpoints and parameters; the rules below target the behavioral and network indicators of CWE-321 exploitation (forged/trusted-payload delivery to ARM listeners, anomalous service-account child processes) rather than a known signature.

Sigma Rule

title: Potential SolarWinds ARM Unauthenticated RCE via Hardcoded Key (CVE-2026-28326)
id: 8b1f2c9e-3a4d-4f7b-9c2e-5d6a7b8c9d0e
status: experimental
description: Detects anomalous child process creation from the SolarWinds Access Rights Manager service, consistent with unauthenticated RCE via CWE-321 static key abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-28326
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-28326
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\SolarWinds.ARMServer.exe'
      - '\ARMServer.exe'
      - '\SolarWinds.AccessRightsManager.exe'
  selection_susp:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\net.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_susp
fields:
  - Image
  - ParentImage
  - CommandLine
  - User
falsepositives:
  - Legitimate ARM maintenance scripts or upgrade processes invoking command interpreters
level: high

YARA Rule

rule CVE_2026_28326_SolarWinds_ARM_Hardcoded_Key_Indicator
{
    meta:
        author = "valtersit.com"
        description = "Heuristic detection for hardcoded static-key artifacts associated with SolarWinds ARM (CVE-2026-28326). Generic CWE-321 indicators only."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-28326"
        cve = "CVE-2026-28326"
        date = "2026-01-01"
        severity = "high"

    strings:
        $arm1 = "Access Rights Manager" ascii wide nocase
        $arm2 = "SolarWinds.ARM" ascii wide nocase
        $kw1  = "hardcoded" ascii wide nocase
        $kw2  = "static key" ascii wide nocase
        $kw3  = "staticKey" ascii wide nocase
        $kw4  = "AES/ECB" ascii wide nocase
        $kw5  = "RijndaelManaged" ascii wide nocase

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) and
        (2 of ($arm*) or ($arm1 and 1 of ($kw*)))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-28326 - Possible SolarWinds ARM Unauthenticated RCE Attempt (Hardcoded Key Abuse)"; flow:established,to_server; content:"POST"; http_method; http.header; content:"Access Rights Manager"; http.header; threshold:type limit, track by_src, count 5, seconds 60; reference:cve,2026-28326; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-28326; classtype:attempted-admin; sid:202628326; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("SolarWinds.ARMServer.exe", "ARMServer.exe", "SolarWinds.AccessRightsManager.exe") and
  process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "certutil.exe")

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security EventCode=4688
| eval parent=lower(ParentProcessName)
| eval child=lower(NewProcessName)
| where (like(parent,"%arm%") OR like(parent,"%accessrights%"))
  AND (like(child,"%cmd.exe") OR like(child,"%powershell.exe") OR like(child,"%pwsh.exe") OR like(child,"%wscript.exe") OR like(child,"%mshta.exe") OR like(child,"%rundll32.exe") OR like(child,"%certutil.exe"))
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmds by host, parent, child, user
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="solarwinds,access_rights_manager,cve-2026-28326,">
  <rule id="2028326" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.parentImage">ARMServer\.exe|AccessRightsManager\.exe</field>
    <field name="win.eventdata.image">cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|certutil\.exe</field>
    <description>CVE-2026-28326: Suspicious child process spawned by SolarWinds Access Rights Manager - possible unauthenticated RCE via hardcoded key</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,rce,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor advisory, fixed version, or patch reference is present in any tracked source. Affected version range is likewise undisclosed. Treat all SolarWinds Access Rights Manager deployments as potentially exposed until the vendor publishes a remediation.

1) Immediate mitigations

• Network isolation: Exploitation requires an adjacent position (AV:A). Restrict ARM listener access to a dedicated management VLAN, enforce strict east-west segmentation, and block workstation-to-ARM-host traffic except from authorized jump hosts.
• Firewall/ACL hardening: Permit only known administrative source IPs to reach ARM services; default-deny all other adjacent traffic.
• Monitoring uplift: Deploy the Sigma/YARA/Suricata/Elastic/Splunk/Wazuh detections above and alert on any ARM service spawning command interpreters or making unexpected outbound connections.
• Credential hygiene: Assume any secrets previously managed or brokered by ARM could be at risk; rotate high-value service-account and directory credentials if intrusion is suspected.

2) Patch/upgrade steps

• Monitor the SolarWinds security advisory portal and the NVD entry for CVE-2026-28326 for an official fixed release. No fixed version is available at time of writing.
• When a patched build is published, validate the hash/signature of the installer, stage the upgrade in a non-production enclave, and verify that any newly provisioned or rotated cryptographic material is unique per deployment (the defining correction for CWE-321).
• After upgrade, rotate any key material or credentials whose confidentiality depended on the previously hardcoded key.

3) Long-term hardening

• Eliminate static cryptographic keys from vendor-supplied software by requiring per-install key generation at deployment time (this is a vendor responsibility — raise it contractually).
• Apply least privilege to the ARM service account; do not run ARM with directory-wide administrative rights.
• Centralize logging from ARM hosts to a SIEM that cannot be tampered with by the ARM service account.
• Include privileged access management infrastructure in purple-team exercises targeting T1190 and lateral-movement scenarios.
• Maintain a software bill of materials (SBOM) and inventory of PAM-tier assets to enable rapid impact assessment when advisories land.

References

1. NVD — CVE-2026-28326: https://nvd.nist.gov/vuln/detail/CVE-2026-28326
2. CWE-321 — Use of Hard-coded Cryptographic Key: https://cwe.mitre.org/data/definitions/321.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. SolarWinds Security Advisory Portal (monitor for ARM advisory): https://www.solarwinds.com/securityadvisory
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-28326 not listed at time of writing): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No evidence of active exploitation, no public PoC, no Nuclei template, and no KEV listing were identified in the supplied intelligence. SolarWinds is a historically targeted vendor, so defenders should treat this as a proactive-priority vulnerability despite the current absence of observed exploitation.