SolarWinds has issued an urgent security advisory for a high-severity vulnerability in its Access Rights Manager (ARM) product, tracked as CVE-2026-28326. The flaw enables unauthenticated attackers to execute arbitrary code remotely on affected systems, posing a serious risk to organizations using the identity and access governance platform.  The vulnerability arises from a hardcoded static key embedded in SolarWinds Access Rights Manager 2026.2 and all earlier releases. Because the key is static and known, an attacker within adjacent network access can exploit it to bypass authentication entirely and run malicious code with high privileges. SolarWinds rates the issue 8.8 (High) under CVSS v3.1, reflecting severe impacts on confidentiality, integrity, and availability.  Patch availability and upgrade path  SolarWinds has released a fixed version, Access Rights Manager 2026.2.1, which removes the hardcoded key and mitigates the remote code execution risk. Customers are advised to upgrade immediately to 2026.2.1 or later. The advisory, first published on September 17, 2026, includes a downloadable PDF with technical details and recommends that administrators verify their current version and schedule emergency patching where ARM is deployed.  Given the “unauthenticated” and “remote code execution” characteristics, this bug is especially dangerous in environments where ARM is exposed to internal networks or poorly segmented zones. An attacker who gains adjacent network access—such as via a compromised workstation or rogue device—could leverage the static key to take control of the ARM server, potentially escalating to broader identity management systems. The CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates low attack complexity and no need for user interaction, amplifying the urgency for remediation.  Safety tips  Organizations using SolarWinds Access Rights Manager should treat CVE-2026-28326 as a priority patching target. Immediate steps include: confirming the installed ARM version; isolating ARM servers from untrusted network segments; applying the 2026.2.1 update; and monitoring logs for suspicious authentication bypass attempts. Security teams should also review network access controls and consider threat-hunting activities focused on ARM-related processes. As with any identity management platform compromise, the downstream risk to Active Directory and other directories is significant, making rapid mitigation essential.

New year, same story. Despite Ivanti's commitment to secure-by-design principles, Chinese threat actors are exploiting its edge devices for the nth time.

A remote code execution vulnerability that lurked in Apache ActiveMQ Classic for 13 years can be chained with an older flaw to bypass authentication and force the broker to retrieve and execute remote configuration files via the Jolokia API. Horizon3.ai identifies the issue as CVE-2026-34197, explains it can be combined with...

​Attackers are now actively targeting over 92,000 end-of-life D-Link Network Attached Storage (NAS) devices exposed online and unpatched against a critical remote code execution (RCE) zero-day flaw.

might use the vulnerability read more about CISA Flags Actively Exploited n8n RCE Bug as 24700 Instances Remain Exposed