> TritonInfoSec News
Home / Sep 20, 2026 / Story
0
#7 The Hacker News general September 19, 2026 at 09:31 UTC

SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE

By [email protected] (The Hacker News)

AI Summary

SolarWinds patched CVE-2026-28326 (CVSS 8.8), a hard-coded cryptographic key vulnerability in Access Rights Manager (ARM) affecting all versions through 2026.2 that enables unauthenticated remote code execution. ARM is used for privileged access governance, making unauthenticated RCE in this product a high-value target for attackers seeking lateral movement into sensitive identity infrastructure.

Read full article → https://thehackernews.com/2026/09/solarwinds-patch…

Relevance score: 82.0/100

# More from September 20

  1. 1
    ShinyHunters hacks Clop leak site, threatens to extort ransomware gang BleepingComputer
  2. 2
    North Korean WaterPlum hackers infected 30,000 devices worldwide BleepingComputer
  3. 3
    Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild The Hacker News
  4. 4
    Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws The Hacker News
  5. 5
    Cisco Zero-Day Highlights API Endpoint Authentication Issues Dark Reading
  6. 6
    CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild The Hacker News
  7. 8
    CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories The Hacker News
  8. 9
    Gyazo server flaw exploited to steal 23.6 million user records BleepingComputer
  9. 10
    Early Scattered Spider member pleads guilty to cybercrime spree CyberScoop