SolarWinds ARM CVE-2026-28326 Hard-Coded Static Key Permits Unauthenticated RCE in All Versions Through 2026.2

The flaw allows any remote attacker to bypass authentication and execute arbitrary code on the Access Rights Manager server. SolarWinds credited researcher Kai Huang and stated no in-the-wild exploitation was known at disclosure. The advisory lists the root cause explicitly as the static key rather than a configuration error.

This is the second SolarWinds product line to ship authentication bypasses in 2026. Web Help Desk CVE-2026-28323 enabled SAML bypass two months earlier; Serv-U received 16 separate fixes the same week. Procurement records show ARM is deployed in at least 14 U.S. federal agencies under existing enterprise agreements.

Hard-coded cryptographic material has appeared in SolarWinds code since the 2020 Orion compromise. The pattern indicates insufficient key-management controls during build pipelines rather than isolated developer error. Contract vehicles for ARM do not require third-party cryptographic audits.

Agencies should inventory ARM instances and apply 2026.2.1 immediately. Expect public exploit code within 60 days given the trivial key extraction path.