SolarWinds has shipped security updates for Access Rights Manager (ARM) after fixing a high-severity flaw that could lead to unauthenticated remote code execution. The vulnerability, tracked as CVE-2026-28326, is rated 8.8 out of 10 on the CVSS scale.
The root cause is a hard-coded key within the product. An attacker who successfully exploits this issue could run code on an affected system without needing valid credentials. Because the flaw is unauthenticated, any reachable ARM deployment is potentially exposed.
Organisations using SolarWinds Access Rights Manager should apply the latest patches as soon as possible. The advisory does not indicate any known in-the-wild exploitation at this time, but the severity and ease of exploitation make prompt action advisable.