A hardcoded authentication secret ships with every SolarWinds Access Rights Manager install, and reaching TCP 55555 is enough to hit a .NET deserialization sink. Bishop Fox confirmed SYSTEM-level code execution, breaks down the root cause, and shares a safe detection tool for defenders.
Master Key Included: Detecting SolarWinds ARM CVE-2026-28326
About this summary. This is a short, independently written summary of an article first published by Bishop Fox. Cyber Security News did not report or verify the underlying story. Read the original: https://bishopfox.com/blog/detecting-solarwinds-arm-cve-2026-28326
Source attribution: headline and facts are from Bishop Fox (bishopfox.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE
SolarWinds has released security updates to address a high-severity flaw in Access Rights Manager (ARM) that, if successfully exploited, could lead to an unauthenticated…
SolarWinds security advisory (AV26-941)
Serial number: AV26-941 Date: September 18, 2026 As of September 17, 2026, SolarWinds is affected by a vulnerability in the following product: SolarWinds Access Rights…
Update your iPhone, iPad, or Mac: Flaw could run attackers’ code
Apple has released updates for iPhones, iPads, and Macs to fix a flaw that could let an attacker run code when a device processes a malicious file. Apple says it may…
OperTraitors: How Kubernetes Operators Betray Your Security Posture
We introduce OperTraitor, a tool to audit privileges of Kubernetes operators, identify excessive RBAC risks, and secure non-human identities.
Fake iPhone Duo preorder scam triggers DarkSword attack
Apple announced its first foldable iPhone on September 9, and scammers were ready to ‘deliver’ one before anyone could buy it. Most of what we found around the launch of…
Apple squashes zero-day bug exploited in “extremely sophisticated” attack (CVE-2026-86950)
Apple has shipped iOS and macOS security updates to fix an actively exploited zero-day vulnerability (CVE-2026-86950) in the operating systems’ Core Graphics framework…