CVE-2026-28326— SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability
Quick assessment
Affected
SolarWinds Access Rights Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SolarWinds Access Rights Manager 被报告存在未认证的远程代码执行漏洞。该问题源于一个硬编码的静态密钥。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SolarWinds | Access Rights Manager | 2026.2 and all previous versions |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-28326
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from a hardcoded static key.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的密码学密钥
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SolarWinds | Access Rights Manager | 2026.2 and all previous versions | - |
|
II. Public POCs for CVE-2026-28326
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-28326
请登录查看更多情报信息。
Vendor Pages for CVE-2026-28326 (3)
-
🔗 404 | SolarWinds vendor-advisory
-
-
🔗 Error release-notes
IV. Related Vulnerabilities
Same product: Access Rights Manager
-
CVE-2024-28991
SolarWinds Access Rights Manager (ARM) Deserialization of Un -
CVE-2024-28990
SolarWinds Access Rights Manager (ARM) Hardcoded Credentials -
CVE-2024-23471
SolarWinds Access Rights Manager (ARM) CreateFile Directory -
CVE-2024-23470
SolarWinds Access Rights Manager (ARM) UserScriptHumster Exp -
CVE-2024-28074
SolarWinds Access Rights Manager (ARM) Internal Deserializat
Same vendor: SolarWinds
-
CVE-2026-28323
SolarWinds Web Help Desk SAML Authentication Bypass Vulnerab -
CVE-2026-28321
SolarWinds Serv-U Broken Access Control Vulnerability -
CVE-2026-28317
SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vu -
CVE-2026-28316
SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vu -
CVE-2026-28315
SolarWinds Serv-U Authenticated Stored Cross-site Scripting
Same weakness: CWE-321
-
CVE-2026-52727
lxc-ci: Pacman keyring stored in archlinux image with a priv -
CVE-2026-81478
Dell OMSA 11.1.0.3 硬编码密钥漏洞 -
CVE-2026-50606
Hard-coded Encryption Key Vulnerability in Acer System Monit -
CVE-2026-50603
Hard-coded encryption key vulnerability in Acer Agent Servic -
CVE-2026-81326
QND硬编码密钥致本地管理员凭据泄露
V. Comments for CVE-2026-28326
No comments yet