An Embedded Key Put the Permissions Manager at Risk
An embedded secret created a route into SolarWinds Access Rights Manager without a login. The vendor identifies CVE-2026-28326 as allowing an attacker to run instructions on the affected system. Versions through 2026.2 are affected; 2026.2.1, released on 17 September, is the first corrected build.
The 8.8 High rating requires a neighbouring network, with neither credentials nor another person’s action. Internet reachability and control of connected directories are not established: consequences depend on deployment and the manager’s granted authority.
The manager’s reach matters
The application analyses and administers access to resources including Active Directory and file services. Treat its account relationships and administrative routes as part of the investigation. A useful response must establish what this installation could reach, rather than assuming either complete isolation or automatic control of the organisation.
The official record’s CISA assessment reported no exploitation on 18 September. No entry appears in the agency’s catalogue released on 26 October. Neither observation proves an absence of attacks. The reviewed record supplies no public demonstration code; that cannot exclude research elsewhere. Comparing vulnerable and corrected software can aid reproduction.
Plan a supported upgrade
The first corrected build is a security threshold, not the latest release. Current vendor guidance lists 2026.4, released on 20 October. Installations older than 2023.2.4 must move through 2023.2.4 before the current version. It also requires this application and SolarWinds Platform to run on separate servers.
- Install a corrected release. Check the installed build, select a supported destination and include the required intermediate upgrade in the change plan.
- Limit management access. Permit only trusted administration systems and authorised users to reach application and administrative interfaces.
- Inventory connected authority. Record the directories, file systems, mailboxes and service credentials available to the manager.
- Investigate the vulnerable period. Review application, Windows, identity and network logs for unexpected access or process execution.
- Preserve recovery evidence. Export relevant logs and configuration before destructive response work.
- Check operational recovery. Verify collectors, group updates, alerts and scheduled actions after the upgrade.
A maintenance release does not need new features to justify closing a security boundary. The earlier headline overstated the release’s scope. The old release-note address now returns a missing-notes message, so the live advisory and current upgrade guidance are the references below.
