SolarWinds Patches ARM Hard-Coded Key Flaw CVE-2026-28326

Executive Summary

SolarWinds has released an emergency security update to resolve a high-severity vulnerability in SolarWinds Access Rights Manager (ARM) that enables unauthenticated remote code execution (RCE) with elevated SYSTEM privileges. The security flaw, designated CVE-2026-28326 and carrying a Common Vulnerability Scoring System (CVSS v3.1) base score of 8.8 (High), impacts all deployments running ARM version 2026.2 and prior.

Access Rights Manager is an identity governance and administration solution deployed across global enterprises to provision, audit, and manage user access across Active Directory, Microsoft Entra ID (Azure AD), Exchange, SharePoint, and on-premises file storage architectures. The vulnerability stems from the implementation of a hard-coded static cryptographic key within the ARM service communications architecture. An unauthenticated attacker positioned on an adjacent internal network or virtual private network (VPN) segment can leverage the embedded static key to bypass cryptographic validation routines, forge privileged service commands, and execute arbitrary code under the Windows NT AUTHORITY\SYSTEM security context.

The flaw was identified and responsibly disclosed by security researcher Kai Huang of Armadin and remediated in ARM 2026.2.1. Although SolarWinds and threat telemetry confirm no active in-the-wild exploitation at the time of advisory publication, identity management platforms like ARM are prime targets for Advanced Persistent Threats (APTs) and ransomware operators seeking immediate Active Directory domain compromise and lateral traversal.

Technical Vulnerability Analysis & Attack Chain

The vulnerability is classified under CWE-321: Use of Hard-coded Cryptographic Key. In enterprise environments, the SolarWinds ARM backend service (pnServer.exe) listens on dedicated TCP endpoints (traditionally TCP port 55555 for core server transactions and TCP 55556 for collector agent coordination) to orchestrate permission analysis, directory synchronizations, and management requests:

[Attacker on Adjacent Network / Compromised Workstation]

│

▼

[Extract Hard-Coded Static Cryptographic Key]

- Discovered in Decompiled Client Binaries / Shared .NET Assemblies

- Symmetric Encryption / Signature Token Key Shared Across Deployments

│

▼

[Craft Malicious Encrypted Serialization / Command Envelope]

- Attacker Forges Privileged Communication Packet Without Valid Credentials

- Encrypts Payload Using the Known Static Key

│

▼

[Transmit Crafted TCP Packet to ARM Service (e.g. TCP/55555)]

- SolarWinds ARM Service (pnServer.exe) Decrypts Payload

- Static Key Matches -> Server Treats Request as Authenticated Internal Task

│

▼

[Arbitrary Code Execution in NT AUTHORITY\SYSTEM Context]

- Deserialization / Dynamic Routine Execution on Windows Server Host

- Adversary Extracts Active Directory Credentials / Modifies Security Groups

1. Hard-Coded Cryptographic Key Architecture (CWE-321)

During internal inter-process and client-server communications between the ARM Administrative Client, distributed agents, and the primary ARM server, cryptographic validation mechanisms were designed to authenticate incoming requests and decrypt sensitive administrative payloads. Rather than generating unique per-installation cryptographic material during setup (such as DPAPI-protected machine keys or ephemeral asymmetric key exchanges), the software relied on a static, compile-time cryptographic key embedded directly inside compiled .NET assemblies.

Because this key was distributed universally across all customer installations, any attacker with local access to an ARM client installation, trial installer, or decompiled binary could extract the identical key material.

2. Authentication Bypass & Payload Forgery

With knowledge of the static key, the authentication layer guarding the ARM service is completely undermined. An unauthenticated attacker on the same network segment can construct synthetic administrative communication packets that mimic legitimate client queries:

• Packet Forgery: The adversary signs or encrypts the payload using the static key.
• Verification Bypass: When the ARM daemon processes the packet, its cryptographic verification routine confirms the signature or successfully decrypts the content using its matching hard-coded key, bypassing access control checks without requesting Active Directory credentials or session tokens.

3. Privilege Escalation & Active Directory Domain Compromise

Because SolarWinds Access Rights Manager requires deep Active Directory visibility and domain administrative privileges to perform user lifecycle operations, the core service (pnServer.exe) operates under the highest local Windows privilege level—NT AUTHORITY\SYSTEM—and frequently possesses delegated Domain Admin or Account Operator privileges across Active Directory:

• Host Compromise: Arbitrary command execution executes as local SYSTEM, allowing adversaries to drop web shells, dump LSASS process memory, and install persistent rootkits.
• Directory Governance Abuse: By manipulating the ARM database and execution engine, attackers can silently inject rogue accounts into privileged Active Directory groups (e.g., Domain Admins, Enterprise Admins), grant shadow administrative rights, and export organization-wide permission trees for targeted espionage.

Threat Actor Profile & Campaign Attribution

• Target Profile: Identity governance solutions are Tier-0 enterprise infrastructure. Enterprise environments utilizing SolarWinds ARM typically hold complex hybrid Active Directory topologies across critical sectors including defense, finance, healthcare, and government agencies.
• Weaponization Vector: While SolarWinds reports no active in-the-wild exploitation to date, identity governance vulnerabilities have historically seen rapid reverse-engineering and exploitation by sophisticated state-sponsored groups and initial access brokers (IABs). Previous SolarWinds ARM deserialization and authentication bypass vulnerabilities (such as CVE-2024-23472 and CVE-2023-35185) were rapidly weaponized for ransomware staging once proof-of-concept details surfaced.
• Coordinated Disclosure: SolarWinds acknowledged Armadin researcher Kai Huang for reporting the vulnerability. The advisory follows recent security rollouts addressing critical vulnerabilities in SolarWinds Web Help Desk (SAML bypass CVE-2026-28323) and Serv-U file transfer platforms.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Immediate Application of ARM 2026.2.1:
  • SolarWinds has officially remediated the flaw in Access Rights Manager 2026.2.1. Security administrators must prioritize upgrading the primary ARM server and updating distributed agent nodes across all monitored domains.
  • Download official installation packages exclusively through the authenticated SolarWinds Customer Portal.
• Compensating Access Controls (If Patching is Delayed):
  • Isolate the ARM server inside an administrative management VLAN.
  • Enforce firewall rules restricting TCP ports 55555 and 55556 strictly to authorized administrative jump boxes (Privileged Access Workstations - PAWs). Block all lateral subnet access.

2. Network & Perimeter Defenses

• Snort / Suricata Detection Rule:
  • Monitor for anomalous or malformed connection attempts targeting the proprietary SolarWinds ARM communication ports from non-whitelisted IP addresses:

alert tcp !$ARM_ADMIN_HOSTS any -> $ARM_SERVERS [55555,55556] (msg:"SECURITY-ARM Unauthorized Inbound Connection to SolarWinds ARM Service Port"; flow:to_server,established; threshold: type limit, track by_src, count 1, seconds 300; classtype:attempted-admin; sid:20262832; rev:1;)

• Zero Trust Micro-Segmentation:
  • Block egress from the ARM server to untrusted external subnets and direct internet gateways. ARM servers should only possess outbound access to verified domain controllers, SIEM endpoints, and update repos.

3. Endpoint Detection & Hunting Query

Sigma Rule: Anomalous Process Spawn from SolarWinds ARM Server

title: SolarWinds ARM Spawning Shell or Scripting Interpreter

status: experimental

description: Detects unusual child processes spawned by SolarWinds Access Rights Manager service (pnServer.exe), indicating potential remote code execution via CVE-2026-28326.

logsource:

category: process_creation

product: windows

detection:

selection:

ParentImage|endswith:

- '\pnServer.exe'

- '\pnAgent.exe'

Image|endswith:

- '\cmd.exe'

- '\powershell.exe'

- '\pwsh.exe'

- '\certutil.exe'

- '\rundll32.exe'

- '\wscript.exe'

- '\cscript.exe'

- '\bitsadmin.exe'

condition: selection

level: critical

tags:

- attack.execution

- attack.t1059.001

- attack.t1059.003

- attack.privilege_escalation

- attack.t1068

Splunk Hunting Query: Privileged SolarWinds ARM Process Activity

index=endpoint (EventCode=1 OR EventCode=4688) ParentImage="*\pnServer.exe"

| eval ChildProcess=lower(NewProcessName)

| where NOT match(ChildProcess, "(pnsrvmgr|pnagent|solarwinds)\.exe$")

| stats count earliest(_time) as first_seen latest(_time) as last_seen by Computer, ParentProcessName, NewProcessName, CommandLine, User

| convert ctime(first_seen) ctime(last_seen)