SolarWinds has patched a critical flaw in Access Rights Manager, the identity governance product enterprises use to track who has access to what across Active Directory, file servers and cloud systems. Tracked as CVE-2026-28326 and rated 8.8 on the CVSS scale, the bug lets an attacker with network access to the ARM service forge authentication tokens using a static cryptographic key baked into the product, then run commands on the host without valid credentials. The Canadian Centre for Cyber Security flagged the advisory the week SolarWinds published it, on September 17. Every ARM version up to 2026.2 is affected; the fix ships in 2026.2.1.
Why it matters: ARM is the kind of product that, by design, sits close to the center of an organization’s identity fabric, which is exactly why a hardcoded key inside it is worse than the same flaw in a peripheral tool. An attacker who reaches the ARM service does not just get a foothold, they get a foothold inside the system other teams rely on to answer “who can touch this” during an incident. SolarWinds has not reported exploitation in the wild as of the advisory date; the flaw was reported through normal disclosure by researcher Kai Huang of Armadin, not discovered after an attack.
The original insight here is about timing, not the bug itself. Static, hardcoded keys in identity products keep surfacing years after “no hardcoded secrets” became baseline secure-development practice, suggesting the gap is less about awareness than about how rarely these code paths get re-audited once a product ships. Cisco’s unauthenticated bypass in its own identity gateway this week and the enforcement gap covered in non-human identity’s blind spot point the same direction: the access-control layer is becoming 2026’s most consistently exploited category, not the applications it protects.
Security teams running ARM should patch to 2026.2.1 immediately, isolate any instance reachable from a general network segment in the meantime, and audit ARM logs for authentication activity that does not map to a known account, since a forged token would not appear as a failed login.
