Affected Systems

SolarWinds Access Rights Manager (ARM) versions 2026.2 and prior. The vulnerability stems from a hard-coded static key that allows unauthenticated remote code execution.

Exploitation Status

No evidence of active exploitation in the wild. Vulnerability discovered and reported by Armadin security researcher Kai Huang. No public PoC mentioned.

Business Impact

High-severity flaw (CVSS 8.8) allows unauthenticated attackers to execute arbitrary code remotely on vulnerable ARM instances. Access Rights Manager is used for identity and access management, making this a critical attack vector for privilege escalation and lateral movement. Organizations using ARM for access governance face risk of complete system compromise without authentication barriers.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Upgrade SolarWinds Access Rights Manager to version 2026.2.1 immediately
  • Audit ARM server logs for unusual unauthenticated connection attempts or anomalous activity prior to patching
  • Restrict network access to ARM servers using firewall rules or network segmentation until patching is complete
  • Review ARM configurations for any unauthorized changes or newly created accounts following patch deployment
  • Monitor SolarWinds security advisories for additional guidance and validate patch deployment across all ARM instances