CVE-2026-28326-check

SolarWinds ARM CVE-2026-28326: a hardcoded shared secret, unauthenticated SYSTEM RCE, and a CVSS score that depends on your firewall We recently dug into CVE-2026-28326 in SolarWinds Access Rights Manager, and we thought there were a few details worth discussing beyond the advisory. The root cause involves a fallback authentication mechanism using a hardcoded secret shipped with the product. The secret is identical across installations of the affected build. That mechanism was intended to support local operations, but the server didn't enforce locality. If an attacker could reach ARM's gRPC listener on TCP 55555, they could bypass authentication and reach a .NET deserialization endpoint. We reproduced the chain and confirmed execution as NT AUTHORITY\SYSTEM. But about that CVSS score... SolarWinds assigned an 8.8 based on adjacent-network reachability, but the software itself doesn't enforce that restriction. On a sufficiently flat network, the same vulnerability scores 9.8. We also found that the patch changed the service's response to unauthenticated requests, which gave us a way to build a safe detector! There's a link to that detector on the page with the full research, but here it is for convenience: BishopFox/CVE-2026-28326-check