CVE-2026-28326: SolarWinds ARM Hard-Coded Key Flaw — Detection and Remediation Guide

---
title: SolarWinds ARM Service Spawning Suspicious Child Processes
id: 3c8f2a41-7b19-4e5d-9a06-2f4c8d1e6b7a
status: experimental
description: Detects the SolarWinds Access Rights Manager service or web processes spawning command interpreters, scripting engines, or download utilities — consistent with post-exploitation following CVE-2026-28326 unauthenticated code execution.
references:
  - https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\SolarWinds\'
      - 'w3wp.exe'
      - '\ARM\'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate ARM administrative scripts or scheduled maintenance tasks invoking command interpreters
level: high
---
title: ARM Service Account Performing Anomalous Network Connections
id: 8d4e6b12-3a57-4c8f-b291-9e7a5d3f1c04
status: experimental
description: Detects SolarWinds ARM server processes initiating outbound network connections to uncommon external destinations, potentially indicating payload retrieval or C2 after exploitation of CVE-2026-28326.
references:
  - https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|contains:
      - '\SolarWinds\'
      - '\ARM\'
    Initiated: 'true'
  filter_internal:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection and not filter_internal
falsepositives:
  - ARM telemetry, licensing, or update check-ins to SolarWinds infrastructure — baseline known-good destinations and alert on deviations
level: medium
---
title: Web Server Process Writing Executables to ARM Directories
id: 5f1a9c37-2d84-4b6e-8f13-7c2b4e9a0d58
status: experimental
description: Detects executable or script file creation within SolarWinds ARM installation directories by non-installer processes, indicating webshell deployment or payload staging following unauthenticated RCE.
references:
  - https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\SolarWinds\'
      - '\Access Rights Manager\'
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
  filter_installer:
    Image|endswith:
      - '\msiexec.exe'
      - '\setup.exe'
  condition: selection and not filter_installer
falsepositives:
  - Legitimate ARM product updates — correlate file creation timestamps with approved change windows
level: high

// Hunt for suspicious child processes spawned by SolarWinds ARM components
// on Windows endpoints monitored by Defender for Endpoint.
// Tune the parent process names to match your actual ARM deployment paths.
let armProcesses = dynamic(["w3wp.exe", "SolarWinds.ARM", "ARMService"]);
let suspiciousChildren = dynamic([
  "cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe",
  "wscript.exe", "cscript.exe", "rundll32.exe",
  "certutil.exe", "bitsadmin.exe", "curl.exe"
]);
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName has_any (armProcesses)
   or InitiatingProcessCommandLine has_any ("SolarWinds", "Access Rights Manager")
| where FileName in~ (suspiciousChildren)
| project TimeGenerated, DeviceName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FileName, ProcessCommandLine,
          AccountName, RemoteIP, SHA256
| order by TimeGenerated desc;

-- Hunt SolarWinds ARM servers for post-exploitation process execution
-- and recently created script/executable artifacts in install directories.
-- Deploy against ARM hosts; adjust install paths to match your environment.

SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(powershell|cmd\.exe|mshta|certutil|bitsadmin)'
  AND (
    Exe =~ '(?i)SolarWinds'
    OR CommandLine =~ '(?i)SolarWinds|Access Rights Manager'
  )

-- Also review recently written web-accessible payloads in ARM directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:/Program Files*/SolarWinds/**/*.as*', accessor='ntfs')
WHERE Mtime > now() - 2592000
ORDER BY Mtime DESC

# Verify SolarWinds ARM version and flag unpatched installs (CVE-2026-28326)
# Run on each ARM server. Requires local admin.

$armPaths = @(
    "${env:ProgramFiles}\SolarWinds",
    "${env:ProgramFiles(x86)}\SolarWinds"
)

$found = $false
foreach ($path in $armPaths) {
    if (Test-Path $path) {
        $found = $true
        Write-Host "[+] ARM installation directory found: $path" -ForegroundColor Yellow
        Get-ChildItem -Path $path -Recurse -Filter *.exe -ErrorAction SilentlyContinue |
            ForEach-Object {
                $v = $_.VersionInfo.ProductVersion
                Write-Host "    $($_.Name)  ProductVersion: $v"
            }
    }
}

if (-not $found) {
    Write-Host "[-] No SolarWinds ARM installation detected on this host." -ForegroundColor Green
    exit 0
}

# Enumerate ARM-related services and their run-as accounts for blast-radius assessment
Write-Host "`n[+] ARM-related services and service accounts:" -ForegroundColor Yellow
Get-CimInstance Win32_Service |
    Where-Object { $_.PathName -match 'SolarWinds|ARM' } |
    Select-Object Name, State, StartName, PathName |
    Format-List

# Check listening ports bound by ARM processes (exposure assessment)
Write-Host "`n[+] Listening ports owned by SolarWinds processes:" -ForegroundColor Yellow
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($proc.Path -match 'SolarWinds') {
            "    {0}:{1}  ->  {2}" -f $_.LocalAddress, $_.LocalPort, $proc.ProcessName
        }
    }

Write-Host "`n[!] ACTION REQUIRED: If ProductVersion is 2026.2 or earlier, the host is vulnerable" -ForegroundColor Red
Write-Host "[!] to CVE-2026-28326. Apply the SolarWinds security update immediately," -ForegroundColor Red
Write-Host "[!] restrict network access to ARM ports, and review child-process telemetry." -ForegroundColor Red