Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Master Key Included: Detecting SolarWinds ARM CVE-2026-28326

bishopfox.com | vulnerability | CVE-2026-28326 | #rce | #deserialization | #detection | #solarwinds | #cve-2026-28326 | #hardcoded-secret

Summary

CVE-2026-28326 is an unauthenticated RCE in SolarWinds ARM where a hardcoded shared secret on TCP 55555 leads to SYSTEM-level code execution. Patch now.
CVE
CVE-2026-28326
Published
Collected

original ↗

Related coverage

vulnerability · netspi.com
CVE-2025-26399 SolarWinds Web Help Desk Overview and Takeaways
CVE-2025-26399 is a critical unauthenticated deserialization flaw (CVSS 9.8) in SolarWinds Web Help Desk, a patch bypass now actively exploited and listed in CISA's KEV catalog.
vulnerability · bishopfox.com
Signature Optional - Analysis of CVE-2026-28323
CVE-2026-28323 is a CVSS 9.8 SAML auth bypass in SolarWinds Web Help Desk. A single forged POST request grants unauthenticated access to any valid account.
vulnerability · bishopfox.com
CVE-2019-18935: Remote Code Execution via Insecure Deserialization in Telerik UI
Caleb Gross details CVE-2019-18935: insecure JSON deserialization in Telerik UI for ASP.NET AJAX yields remote code execution; includes the CVE-2017-11317 upload chain and patching.
vulnerability · bishopfox.com
OpenMRS - Insecure Object Deserialization
Critical insecure object deserialization in OpenMRS (CVE-2018-19276) lets unauthenticated attackers run commands via the REST API, risking massive healthcare data exposure.
vulnerability · bishopfox.com
SolarWinds Log & Event Manager - Improper Access Control
Advisory for improper access control in SolarWinds LEM (CVE-2017-7646): via nano in restricted mode, an authenticated user could browse the appliance filesystem and read the admin password hash.
vulnerability · bishopfox.com
SolarWinds Log & Event Manager - Arbitrary Command Injection
Advisory for an arbitrary command injection in SolarWinds Log & Event Manager (CVE-2017-7647): an authenticated user could escape the CMC console and run commands as root; fixed in 6.3.1 HF4.
back