Post

SolarWinds shipped a hard-coded key in Access Rights Manager. Unauthenticated RCE, CVSS 8.8, fixed in ARM 2026.2.1. Same cycle: a CVSS 9.8 SAML bypass in Web Help Desk. Patch both: https://secureinseconds.com/blog/2026-09-20-solarwinds-arm-hard-coded-key-unauthenticated-rce