SolarWinds Access Rights Manager CVE-2026-28326 – Unauthenticated RCE From Hard-Coded Key

Threat Overview

SolarWinds disclosed CVE-2026-28326 on September 17 and CERT reporting amplified it September 18-19. The flaw is a hard-coded static cryptographic key in Access Rights Manager that can enable unauthenticated remote code execution for an attacker with network access to the affected service. CVSS is 8.8 with an adjacent-network vector. SolarWinds reports no known exploitation in the wild.

References

SolarWinds security advisory, September 17, 2026.
Canadian Centre for Cyber Security AV26-941, September 18, 2026: https://www.cyber.gc.ca/en/alerts-advisories/solarwinds-security-advisory-av26-941

Impacted Systems

SolarWinds Access Rights Manager 2026.2 and earlier on Windows/on-prem enterprise deployments. Fixed in ARM 2026.2.1. Exploitation requires network reachability but not authentication.

Why this matters

ARM manages access rights across Active Directory and Windows resources, making an RCE-capable management server a high-value identity and lateral-movement pivot.

Exploitation Status

No active exploitation is reported by SolarWinds and the vulnerability is not currently in CISA KEV.

What this hunt looks for

ARM software inventory, SolarWinds processes spawning shells, unexpected network connections, file creation, persistence, and new Windows services.

Required logs

Defender XDR DeviceTvmSoftwareInventory, DeviceProcessEvents, DeviceNetworkEvents and DeviceFileEvents, plus Windows SecurityEvent where available.

First Pass – SolarWinds ARM Software Inventory

DeviceTvmSoftwareInventory
| where SoftwareVendor has "SolarWinds" or SoftwareName has "Access Rights Manager"
| project DeviceName,SoftwareVendor,SoftwareName,SoftwareVersion,EndOfSupportStatus
| order by DeviceName asc

SolarWinds Processes Spawning Shells

DeviceProcessEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFolderPath has "SolarWinds" or InitiatingProcessCommandLine has "SolarWinds"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","rundll32.exe")
| project Timestamp,DeviceName,AccountName,InitiatingProcessFileName,InitiatingProcessCommandLine,FileName,ProcessCommandLine,SHA256
| order by Timestamp desc

ARM Server Network Activity

let ArmDevices=DeviceTvmSoftwareInventory
| where SoftwareName has "Access Rights Manager"
| distinct DeviceId;
DeviceNetworkEvents
| where Timestamp >= ago(30d)
| where DeviceId in (ArmDevices)
| project Timestamp,DeviceName,InitiatingProcessFileName,InitiatingProcessCommandLine,RemoteUrl,RemoteIP,RemotePort
| order by Timestamp desc

Files Created by SolarWinds Processes

DeviceFileEvents
| where Timestamp >= ago(30d)
| where InitiatingProcessFolderPath has "SolarWinds" or InitiatingProcessCommandLine has "SolarWinds"
| where ActionType in~ ("FileCreated","FileModified")
| project Timestamp,DeviceName,ActionType,FileName,FolderPath,SHA256,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp desc

Persistence Following SolarWinds Activity

DeviceProcessEvents
| where Timestamp >= ago(30d)
| where FileName in~ ("schtasks.exe","sc.exe","reg.exe","powershell.exe","cmd.exe")
| where InitiatingProcessFolderPath has "SolarWinds" or InitiatingProcessCommandLine has "SolarWinds"
| project Timestamp,DeviceName,AccountName,FileName,ProcessCommandLine,InitiatingProcessFileName,InitiatingProcessCommandLine
| order by Timestamp desc

Windows New Service Fallback

SecurityEvent
| where TimeGenerated >= ago(30d)
| where EventID == 7045
| project TimeGenerated,Computer,Account,Activity,EventData
| order by TimeGenerated desc

Detection Notes

Inventory is the highest-value first pass. SolarWinds process names can vary, so path and command-line pivots avoid inventing a specific executable. Post-exploitation queries are behavioral and are not proof of CVE exploitation.