SolarWinds has disclosed a critical remote code execution vulnerability in its Access Rights Manager (ARM) product, tracked as CVE-2026-58138. The vulnerability affects ARM versions prior to 2026.2 and allows unauthenticated remote code execution.
Vulnerability Details
CVE-2026-58138 is a remote code execution flaw in the ARM web server component. A specially crafted HTTP request can trigger the vulnerability, allowing an attacker to execute arbitrary code on the server with the privileges of the ARM service account.
The vulnerability does not require authentication — an attacker can exploit it remotely without valid credentials. This makes it particularly dangerous for internet-facing ARM deployments.
Affected Versions
- SolarWinds ARM 2026.1 and earlier
- ARM versions shipped before the 2026.2 release
Version 2026.2 includes the fix.
SolarWinds's Response
SolarWinds has released version 2026.2 with the patch and recommends that all customers update immediately. The company's security advisory provides detailed migration instructions.
Why This Matters
SolarWinds ARM is deployed in enterprise environments for:
- Access rights management and auditing
- User permission analysis
- Compliance reporting
- Active Directory integration
A compromised ARM server could give attackers visibility into the entire access control infrastructure of an organization — a high-value target.
Recommendations
- Update to ARM 2026.2 or later immediately
- If update is not immediately possible, restrict network access to the ARM web interface
- Monitor ARM server logs for suspicious HTTP requests
- Review access logs for signs of exploitation