CVE-2026-28326: SolarWinds Access Rights Manager Hard-coded Key Remote Code Execution

HERMES

HERMES THREAT SCORE & ENTERPRISE AD PRIVILEGE ESCALATION

Target: SolarWinds Access Rights Manager (ARM) — RabbitMQ / WCF Remote Dispatcher Service

Confidence: 95%

90 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 18 / 20

Threat Activity 18 / 20

Weaponization 18 / 20

Exposure 18 / 20

Prevalence 17 / 20

Impact 20 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 19 / 20

⚖️ Divergence & Operational Rationale

Rated CVSS 8.8 (due to Adjacent Network vector AV:A) and HTS 90 (CRITICAL). SolarWinds ARM servers manage access permissions, audit logs, and domain user provisioning across Active Directory environments. An unauthenticated attacker positioned on the corporate network or VPN can forge encrypted RPC messages using static hardcoded keys to achieve immediate SYSTEM-level code execution on the ARM host.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-28326: SolarWinds Access Rights Manager Hard-coded Key Remote Code ExecutionVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTSolarWinds Access Rights Manager

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in SolarWinds Access Rights Manager documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical SolarWinds Security Advisory: September 2026

CVSS v3.1: 8.8 High (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) / CWE-321: Use of Hard-coded Cryptographic Key / CWE-502: Deserialization of Untrusted Data. Affects SolarWinds Access Rights Manager 2024.3, 2024.3.1, and prior versions. Resolved in SolarWinds ARM version 2026.2.1.

Executive Summary

In September 2026, SolarWinds disclosed CVE-2026-28326, a severe remote code execution vulnerability impacting SolarWinds Access Rights Manager (ARM). The vulnerability is caused by the use of a hardcoded symmetric cryptographic key embedded within the ARM client-server communication binaries. An unauthenticated attacker with adjacent network access to the ARM service ports (TCP 55555 / RabbitMQ) can encrypt forged serialized command payloads that the server decrypts and executes under NT AUTHORITY\SYSTEM.

---

1. Technical Context & Affected Software Matrix

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-28326	SolarWinds Advisory & ZDI-CAN
Vulnerability Class	Hard-coded Key (CWE-321) & Insecure Deserialization (CWE-502)	Unauthenticated remote code execution as SYSTEM
Affected Component	RabbitMQ / WCF Remote Communication Dispatcher	TCP port 55555 / 5672
Authentication Required	None (PR:N)	Message encrypted with static embedded key
User Interaction	None (UI:N)	Automated execution upon receiving RPC message
Scope Impact	Unchanged (S:U)	Windows server takeover (Active Directory management engine)
Privileges Obtained	NT AUTHORITY\SYSTEM	Complete control over Windows host and ARM database
Affected Versions	SolarWinds ARM 2024.3, 2024.3.1 and earlier	Enterprise SolarWinds ARM installations
Remediation Target	SolarWinds ARM 2026.2.1	Upgrade to patched release with ephemeral key negotiation

---

2. Vulnerability Anatomy & Root Cause Analysis

SolarWinds ARM relies on an encrypted Windows Communication Foundation (WCF) service layer for communications between administrative consoles and the central server.

sequenceDiagram
    autonumber
    actor Attacker as Adjacent Attacker (LAN / VPN)
    participant WCF as ARM Service Listener (Port 55555)
    participant Crypto as Decryption Routine (Static Key)
    participant Dispatcher as Deserialization Engine
    participant OS as Windows Host (SYSTEM)

    Attacker->>WCF: Send forged binary payload encrypted with static AES key
    WCF->>Crypto: Decrypt payload using hardcoded key from assembly
    Crypto->>Dispatcher: Forward valid plaintext serialized stream
    Dispatcher->>Dispatcher: Execute deserialization gadget chain
    Dispatcher->>OS: Execute command with NT AUTHORITY\SYSTEM privileges

1. The encryption key utilized to protect WCF messages is statically embedded within client and server .NET binaries (pnServer.exe and pnClient.exe).
2. Because the key is identical across all customer installations, any attacker on the adjacent network can forge validly encrypted serialized messages.
3. Upon receiving the payload, the server decrypts it successfully and deserializes the untrusted stream, executing arbitrary commands under the SYSTEM account.

---

3. Detection Engineering & Threat Hunting

Sigma Rule (SolarWinds ARM Service Spawning Shells)

title: SolarWinds ARM Service Spawning Command Shell
id: cve-2026-28326-arm-spawn
status: production
description: Detects pnServer.exe spawning command line interpreters or PowerShell processes.
references:
  - https://www.solarwinds.com/trust-center/security-advisories
author: Hermes Codex DFIR Team
date: 2026-09-17
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\pnServer.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
level: critical
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003

---

4. Remediation, Patching & Hardening

1. T0 Immediate Action (< 24h) — Upgrade to SolarWinds ARM 2026.2.1: Download and install the official SolarWinds ARM 2026.2.1 installer, which implements ephemeral dynamic key exchange over TLS.
2. T0 Mitigation — Firewall Port 55555: Restrict access to TCP port 55555 on ARM server hosts strictly to approved administrator workstations via Windows Defender Firewall or corporate network firewalls.
3. T1 Tactical Audit (< 7d) — Audit Active Directory User Changes: Verify recent permissions modifications and new administrative accounts in Active Directory created through SolarWinds ARM.

---

5. Related Intelligence & Attack Paths

SolarWinds Software Intelligence Track vulnerability trends and software security posture across SolarWinds products.

Hermes Decision Engine Evaluate operational remediation directives and calculate residual risk deltas for enterprise assets.

Private Stack Audit Audit your identity and access management stack against CVE-2026-28326 privately in your browser.