CTI · reviewed · 2026-09-20

SolarWinds patches CVE-2026-28326 in Access Rights Manager - unauthenticated RCE via hard-coded key

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1078 Valid Accounts Stealth
• T1059 Command and Scripting Interpreter Execution

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: SolarWinds Access Rights Manager Hard-Coded Credential Exploitation
id: b8f4d2e5-9a3c-4b0f-c6e7-2d9f8a4b3c5d
status: experimental
description: Detects exploitation of CVE-2026-28326 in SolarWinds Access Rights Manager via hard-coded static cryptographic key enabling unauthenticated RCE.
references:
  - https://thehackernews.com
author: Tia N. List
date: 2026-09-20
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_arm:
    Image|endswith:
      - '\SolarWinds ARM Service.exe'
      - '\Arm.exe'
  selection_suspicious_child:
    ParentImage|contains: 'ARM'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\net1.exe'
  condition: selection_arm and selection_suspicious_child
falsepositives:
  - Legitimate SolarWinds ARM administration
level: high

References

• https://thehackernews.com
• https://www.deafnews.it