Master Key Included: Detecting SolarWinds ARM CVE-2026-28326
ResearchSolarWinds Access Rights ManagerOur summary
Bishop Fox researchers detail CVE-2026-28326, an unauthenticated remote code execution flaw in SolarWinds Access Rights Manager (ARM) that was fixed in version 2026.2.1.7. The root cause is a static authentication secret shipped identically in every installation, letting anyone who can reach TCP port 55555 bypass the certificate check and reach a .NET deserialization sink, which the team confirmed grants SYSTEM-level code execution. SolarWinds rates the issue 8.8 on CVSS, assuming only adjacent-network access, but the researchers note the score can rise to 9.8 if the port is reachable from a flatter network than intended. There is no evidence of in-the-wild exploitation; this is defensive research accompanied by a free detection tool that checks patch status with two safe network requests. Organizations running ARM should upgrade to 2026.2.1.7 or later and tightly restrict access to port 55555.
Below is the opening; the full story is at Bishop Fox.
From Bishop Fox
TL;DR
Identity governance software decides who may open which file, mailbox, and account across a company, which makes any one of them a shortcut to all of it. This post is about a flaw that hands that position to anyone who can reach the server.
CVE-2026-28326 is an unauthenticated RCE in SolarWinds Access Rights Manager, fixed in 2026.2.1.7. A client-authentication secret ships with the product, identical on every install, so reaching TCP 55555 is enough to hit a .NET deserialization sink. SolarWinds scored it 8.8 on a vector that assumes adjacent-network reach; check how far your 55555 is exposed. We confirmed execution as
NT AUTHORITY\SYSTEM. Our CVE-2026-28326-check">detection tool determines whether an asset is vulnerable with two safe requests.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.