A critical remote code execution vulnerability in SolarWinds Access Rights Manager, caused by a hardcoded cryptographic key, poses a severe risk of total system compromise to affected environments.

The application utilizes a hardcoded static cryptographic key, which enables an unauthenticated attacker to bypass security controls and execute arbitrary code on the host system.

Successful exploitation of this vulnerability allows an attacker to gain full control over the affected SolarWinds Access Rights Manager instance. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to complete data compromise, unauthorized administrative access, and significant operational disruption. Organizations relying on this software for identity and access management are at heightened risk of lateral movement and persistence by malicious actors.

Immediate Action: Upgrade to SolarWinds Access Rights Manager version 2026.2.1 immediately to remove the vulnerable hardcoded key.

Proactive Monitoring: Review system and application logs for unusual execution patterns or unauthorized access attempts originating from internal network segments.

Compensating Controls: Restrict network access to the Access Rights Manager interface to only trusted administrative workstations, as the vulnerability is reachable via the adjacent network.

Public Exploit Available: No

The presence of a hardcoded cryptographic key constitutes a fundamental security failure that cannot be mitigated by configuration changes alone. It is imperative that administrators prioritize the update to version 2026.2.1 across all deployments. Failure to patch this vulnerability leaves the environment exposed to potential remote code execution by any actor with network access to the application.