SolarWinds Patches Access Rights Manager Flaw Enabling Unauthenticated RCE
Summary
SolarWinds patched CVE-2026-28326, a high-severity hard-coded-key flaw that could enable unauthenticated RCE in Access Rights Manager versions 2026.2 and earlier. It also released fixes for vulnerabilities in Web Help Desk and Serv-U.
Key points
- CVE-2026-28326 affects Access Rights Manager 2026.2 and earlier and is rated 8.8 CVSS.
- The flaw stems from a hard-coded static key and could enable unauthenticated remote code execution.
- SolarWinds fixed the issue in Access Rights Manager 2026.2.1; the company did not report in-the-wild exploitation.
- SolarWinds credited security researcher Kai Huang with discovering and reporting the Access Rights Manager flaw.
- Web Help Desk fixes address a SAML authentication bypass and a denial-of-service flaw; both are resolved in version 2026.2.1.
- SolarWinds also fixed 16 Serv-U vulnerabilities that could enable privilege escalation, remote code execution, or administrator account creation.
Article Details
- Vulnerability Types
- Unauthenticated remote code execution caused by a hard-coded static key
- SAML authentication bypass
- Denial of service caused by insufficient memory
- Privilege escalation
- Remote code execution
- Unauthorized administrator account creation
- Severity
- High; CVE-2026-28326 is rated 8.8/10.0 CVSS.
- Affected Versions
- Access Rights Manager 2026.2 and earlier
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
CVE-2026-28299Another vulnerability relates to a denial-of-service (DoS) vulnerability (CVE-2026-28299, CVSS score: 8.2) that could cause the Web Help Desk server to crash due to insufficient memory.CVE-2026-28302SolarWinds has also released fixes for 16 flaws impacting Serv-U (CVE-2026-28302, from CVE-2026-28304 through CVE-2026-28317, CVE-2026-28321, CVE-2026-28323) that could lead to privilege escalation, remote codeCVE-2026-28304SolarWinds has also released fixes for 16 flaws impacting Serv-U (CVE-2026-28302, from CVE-2026-28304 through CVE-2026-28317, CVE-2026-28321, CVE-2026-28323) that could lead to privilege escalation, remote codeCVE-2026-28323nearly two months after the company shipped fixes for a critical flaw impacting Web Help Desk (WHD) (CVE-2026-28323, CVSS score: 9.8) that could result in a SAML authentication bypass when the SAML 2.0 authenticationCVE-2026-28326SolarWinds has patched a high-severity vulnerability in Access Rights Manager, tracked as CVE-2026-28326, that could allow unauthenticated remote code execution due to a hard-coded static key.
People
Vendors
Products
Access Rights ManagerSolarWinds has patched a high-severity vulnerability in Access Rights Manager, tracked as CVE-2026-28326, that could allow unauthenticated remote code execution due to a hard-coded static key.SolarWinds Serv-UThe company also released fixes for serious flaws in Web Help Desk and multiple Serv-U issues, including risks of privilege escalation, remote code execution, and administrator account creation.SolarWinds Web Help DeskThe company also released fixes for serious flaws in Web Help Desk and multiple Serv-U issues, including risks of privilege escalation, remote code execution, and administrator account creation.