{"metadata": {"vulnerability": "CVE-2026-28326", "count": 39, "kinds": {"milestone": 6, "sighting": 23, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-02-26T14:46:41.521Z", "date_only": false, "value": "2026-02-26T14:46:41.521Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-28326", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-17T00:00:00Z", "date_only": true, "value": "2026-09-17", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1211", "record": "CERTFR-2026-AVI-1211", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-09-17T16:30:31.734Z", "date_only": false, "value": "2026-09-17T16:30:31.734Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-28326", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-17T16:30:31.734Z", "date_only": false, "value": "2026-09-17T16:30:31.734Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / SolarWinds", "record": "CVE-2026-28326", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-17T17:16:39Z", "date_only": false, "value": "2026-09-17T17:16:39Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VJV8-GHPR-HW4Q", "record": "GHSA-VJV8-GHPR-HW4Q", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-17T17:16:39.960Z", "date_only": false, "value": "2026-09-17T17:16:39.960", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-28326", "record": "FKIE_CVE-2026-28326", "field": "published"}, {"timestamp": "2026-09-17T17:52:22.517Z", "date_only": false, "value": "2026-09-17T17:52:22.517499Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/i3uesu6gf6led", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "52b5f9d5-86fd-4dc1-9c72-ba4391bf8362", "content": "CVE-2026-28326 - SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability\nCVE ID : CVE-2026-28326\n \n Published : Sept. 17, 2026, 4:30 p.m. | 35\u00a0minutes ago\n \n Description : SolarWinds Access Rights Manager was reported to be affected by an unauthent...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/i3uesu6gf6led"}, {"timestamp": "2026-09-17T18:31:47Z", "date_only": false, "value": "2026-09-17T18:31:47Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VJV8-GHPR-HW4Q", "record": "GHSA-VJV8-GHPR-HW4Q", "field": "published"}, {"timestamp": "2026-09-17T18:31:47Z", "date_only": false, "value": "2026-09-17T18:31:47Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VJV8-GHPR-HW4Q", "record": "GHSA-VJV8-GHPR-HW4Q", "field": "modified"}, {"timestamp": "2026-09-17T21:18:54.607Z", "date_only": false, "value": "2026-09-17T21:18:54.607407Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mvqlef2zbp2x", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "1413b27e-80a7-4613-bd90-e160f471ec63", "content": "SolarWinds Access Rights Manager\u306b\u30cf\u30fc\u30c9\u30b3\u30fc\u30c9\u3055\u308c\u305f\u9759\u7684\u30ad\u30fc\u306b\u3088\u308b\u8a8d\u8a3c\u4e0d\u8981\u306e\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\u306e\u8106\u5f31\u6027\u304c\u3042\u308b\u3002\u653b\u6483\u8005\u306f\u30ea\u30e2\u30fc\u30c8\u3067\u30b3\u30fc\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u3068\u306a\u308b\u3002\nCVE-2026-28326 CVSS 8.8 | HIGH", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mvqlef2zbp2x"}, {"timestamp": "2026-09-18T03:56:17.882Z", "date_only": false, "value": "2026-09-18T03:56:17.882159Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-28326", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-18T03:56:17.882Z", "date_only": false, "value": "2026-09-18T03:56:17.882159Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-28326", "record": "FKIE_CVE-2026-28326", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-18T13:41:15.553Z", "date_only": false, "value": "2026-09-18T13:41:15.553Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-28326", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-18T13:41:15.553Z", "date_only": false, "value": "2026-09-18T13:41:15.553Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-28326", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-18T19:07:38.320Z", "date_only": false, "value": "2026-09-18T19:07:38.320", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-28326", "record": "FKIE_CVE-2026-28326", "field": "lastModified"}, {"timestamp": "2026-09-18T20:15:02.575Z", "date_only": false, "value": "2026-09-18T20:15:02.575912Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/solarwinds-security-advisory-av26-941", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "cb524e18-6835-40c7-9ff3-1c00ab924054", "url": "https://cyber.gc.ca/en/alerts-advisories/solarwinds-security-advisory-av26-941"}, {"timestamp": "2026-09-19T12:00:06.052Z", "date_only": false, "value": "2026-09-19T12:00:06.052324Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/thehackernews/10105", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "98ad0de4-a580-4985-b869-3f71eef25565", "content": "\ud83d\udea8 A hard-coded static key in SolarWinds ARM can enable unauthenticated RCE.\n\nCVE-2026-28326 affects ARM 2026.2 and earlier and is fixed in 2026.2.1. SolarWinds did not report in-the-wild exploitation.\n\nRead: https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html", "url": "https://t.me/thehackernews/10105"}, {"timestamp": "2026-09-19T12:02:14.739Z", "date_only": false, "value": "2026-09-19T12:02:14.739543Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/9cb86acb682c54ea7f3ed1ba71a63335", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "4595400b-c701-4626-88c8-47a4ae53902d", "content": "This daily threat intelligence roundup highlights critical software vulnerabilities and emerging AI security risks. Key traditional threats include unauthenticated RCEs in SolarWinds Access Rights Manager (CVE-2026-28326, patched), Orkes Conductor (CVE-2026-58138, actively exploited), and a critical command injection flaw in Totolink routers (CVE-2026-93742, public exploit). A high-severity authenticated RCE also affects The Welcomizer WordPress plugin (CVE-2026-4327). On the AI front, Google\u2019s Gemini model accidentally breached real corporate systems during a May 2026 security test due to a domain mix-up, while industry discussions emphasize that prompt injection and LLM routing flaws have become primary security challenges in AI agent development. Collectively, the reports underscore a threat landscape defined by high-impact software exploits and rapidly evolving AI vulnerabilities.", "url": "https://gist.github.com/ichintu/9cb86acb682c54ea7f3ed1ba71a63335"}, {"timestamp": "2026-09-19T12:09:22.109Z", "date_only": false, "value": "2026-09-19T12:09:22.109086Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mvunljroyd2g", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "d9f1cc2e-3c6d-499c-9150-de4f3ceeb00d", "content": "SolarWinds Patches Hard-Coded Cryptographic Key in ARM: CVE-2026-28326", "url": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mvunljroyd2g"}, {"timestamp": "2026-09-19T12:45:21.050Z", "date_only": false, "value": "2026-09-19T12:45:21.050789Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvuplvrs5f2x", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "a8f5443d-a0ab-408c-b9d2-ea4fc7f3d4db", "content": "SolarWinds patched CVE-2026-28326 in Access Rights Manager, fixing a hard-coded key flaw that could allow unauthenticated RCE across version 20. Also addressed serious issues in Web Help Desk and Serv-U. #SolarWinds #ARM #RCE", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvuplvrs5f2x"}, {"timestamp": "2026-09-19T13:00:34.729Z", "date_only": false, "value": "2026-09-19T13:00:34.729603Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "0175362c-de75-4414-9b08-d41f27e5bc56", "content": "SolarWinds has released security updates to address a high-severity flaw in Access Rights Manager (ARM) that, if successfully exploited, could lead to an unauthenticated remote code execution vulnerability.\n\nThe vulnerability, tracked as CVE-2026-28326, is rated 8.8 out of 10.0 on the CVSS scoring system. The issue affects all versions of Access Rights Manager 2026.2 and prior.\n\n\"SolarWinds", "url": "https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html"}, {"timestamp": "2026-09-20T01:00:04.742Z", "date_only": false, "value": "2026-09-20T01:00:04.742111Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/VulnerabilityNews/44501", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "0438036e-f8e8-4ebf-a7b2-35ce9fc37eaf", "content": "SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE\n\nSolarWinds has released security updates to address a high-severity flaw in Access Rights Manager (ARM) that, if successfully exploited, could lead to an unauthenticated remote code execution vulnerability.\n\nThe vulnerability, tracked as CVE-2026-28326, is rated 8.8 out of 10.0 on the CVSS scoring system. The issue affects all versions of Access Rights Manager 2026.2 and prior.\n\n\"SolarWinds\nhttps://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html", "url": "https://t.me/VulnerabilityNews/44501"}, {"timestamp": "2026-09-20T01:51:19.411Z", "date_only": false, "value": "2026-09-20T01:51:19.411662Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvw3jds2hu26", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "73fa88c7-b75c-4b47-bc3d-51dff4b34c28", "content": "\ud83e\udd16 CVE-2026-28326 (CVSS 8.8): SolarWinds Access Rights Manager ships a hard-coded cryptographic key enabling unauthenticated RCE. Affects ARM 2026.2 and prior; patch released.\nhttps://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mvw3jds2hu26"}, {"timestamp": "2026-09-20T06:34:46.455Z", "date_only": false, "value": "2026-09-20T06:34:46.455672Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/abijita.bsky.social/post/3mvwle6x7lq25", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "b46fccd0-f765-4451-8ab9-128b4d5974e1", "content": "SolarWinds Fixes Critical ARM Vulnerability Allowing Remote Code\u00a0Execution\n\nSolarWinds has released a security update for Access Rights Manager to fix CVE-2026-28326, a high-severity vulnerability that could enable unauthenticated remote code execution.", "url": "https://bsky.app/profile/abijita.bsky.social/post/3mvwle6x7lq25"}, {"timestamp": "2026-09-20T10:45:19.044Z", "date_only": false, "value": "2026-09-20T10:45:19.044566Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mvwze6xbxs2b", "record": "cve-2026-28326", "field": "creation_timestamp", "uuid": "7645ab4c-1b95-4fe2-a47b-5f2ef462928c", "content": "SolarWinds ARM through 2026.2: hard-coded key enables unauthenticated RCE. CVE-2026-28326, CVSS 8.8. Patch to ARM\u2026 https://0daynews.com/articles/2026-09-20-solarwinds-arm-cve-2026-28326-hardcoded-key-rce/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-2656", "url": "https://bsky.app/profile/0daynews.bsky.social/post/3mvwze6xbxs2b"}, {"timestamp": "2026-09-20T15:51:05.890Z", "date_only": false, "value": "2026-09-20T15:51:05.890210Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mvxkgxpaan24", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "f763ec09-1d0b-4de8-a9b8-f606d95aeba1", "content": "SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE (CVE-2026-28326) #patchmanagement", "url": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mvxkgxpaan24"}, {"timestamp": "2026-09-20T17:05:13.405Z", "date_only": false, "value": "2026-09-20T17:05:13.405804Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/tomcat/statuses/117304453563682831", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "de81faaa-bc2c-4dbb-9fa4-230e57b2abce", "content": "\ud83d\udea8 A hard-coded static key in SolarWinds ARM can enable unauthenticated RCE.\nCVE-2026-28326 affects ARM 2026.2 and earlier and is fixed in 2026.2.1. SolarWinds did not report in-the-wild exploitation.\nRead: https://thehackernews.com/2026/09/solarwinds-patches-arm-hard-coded-key.html", "url": "https://infosec.exchange/users/tomcat/statuses/117304453563682831"}, {"timestamp": "2026-09-21T13:00:04.659Z", "date_only": false, "value": "2026-09-21T13:00:04.659633Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/3010", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "633d15f4-0b6d-4ff0-b0c4-f65a4a2b737b", "content": "A hard-coded static key in SolarWinds ARM can enable unauthenticated RCE.\n\nCVE-2026-28326 affects ARM 2026.2 and earlier and is fixed in 2026.2.1. SolarWinds did not report in-the-wild exploitation.", "url": "https://t.me/CyberDispatch/3010"}, {"timestamp": "2026-09-22T00:00:00Z", "date_only": false, "value": "2026-09-22T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1211", "record": "CERTFR-2026-AVI-1211", "field": "last_revision_date"}, {"timestamp": "2026-09-22T00:00:00Z", "date_only": false, "value": "2026-09-22T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1211", "record": "CERTFR-2026-AVI-1211", "field": "initial_release_date"}, {"timestamp": "2026-09-22T00:00:00Z", "date_only": false, "value": "2026-09-22T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1211", "record": "CERTFR-2026-AVI-1211", "field": "revisions.0.revision_date"}, {"timestamp": "2026-09-22T07:00:04.382Z", "date_only": false, "value": "2026-09-22T07:00:04.382633Z", "kind": "sighting", "label": "Seen", "source": "Telegram/1-EB3sD2oC0U6c2SZrR9j-FHDJPzOjVG4szn66l4DgZ9Jg", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "d9659f66-4472-47a7-a6e5-d69081462662"}, {"timestamp": "2026-09-22T12:20:07.464Z", "date_only": false, "value": "2026-09-22T12:20:07.464383Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mw47lkmd6e2i", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "dade843f-057c-4fa7-9828-fa848a340242", "content": "\ud83d\udd17 CVE : CVE-2026-28326", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3mw47lkmd6e2i"}, {"timestamp": "2026-09-25T01:02:05.459Z", "date_only": false, "value": "2026-09-25T01:02:05.459879Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mwcl3u4w5c27", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "2161445f-bef4-4145-95a0-da878422b4e7", "content": "SolarWinds Access Rights Manager\u306b\u672a\u8a8d\u8a3cRCE\u306e\u8106\u5f31\u6027 CVE-2026-28326\u3000\u4fee\u6b63\u72482026.2.1\u3092\u516c\u958b \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "url": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mwcl3u4w5c27"}, {"timestamp": "2026-09-26T07:18:43.030Z", "date_only": false, "value": "2026-09-26T07:18:43.030942Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/sagastar.bsky.social/post/3mwfqmbfa5227", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "06e42096-43c6-4076-8aa3-4951827c3b19", "content": "perhaps, but i think of stuff like solarwinds.\n\nlet's get in the w-w-wayback machine. remember solarwinds123?\n\nedition.cnn.com/2021/02/26/p...\n\ncan't blame the intern for doing it again with CVE-2026-28326", "url": "https://bsky.app/profile/sagastar.bsky.social/post/3mwfqmbfa5227"}, {"timestamp": "2026-09-26T14:24:46.838Z", "date_only": false, "value": "2026-09-26T14:24:46.838933Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/samilaiho.com/post/3mwgig355mc2m", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "ed51b66c-aa9c-4e95-a0e7-8c5c454c00c8", "content": "Master Key Included: Detecting SolarWinds ARM CVE-2026-28326\nbishopfox.com/blog/detecti...", "url": "https://bsky.app/profile/samilaiho.com/post/3mwgig355mc2m"}, {"timestamp": "2026-09-26T19:39:32.318Z", "date_only": false, "value": "2026-09-26T19:39:32.318666Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwgzyyhxmx2r", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "85031e04-ab70-4497-9eb4-45910186349b", "content": "Master Key Included: Detecting SolarWinds ARM CVE-2026-28326", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwgzyyhxmx2r"}, {"timestamp": "2026-09-26T20:54:04Z", "date_only": false, "value": "2026-09-26T20:54:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/s9CMbafGxJ8JqKG796dnEpbweDXUA3ls6IAfSPJNMMlCcbA", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "2eafb002-8e27-4104-897d-5a3156244159"}, {"timestamp": "2026-10-09T20:39:09.767Z", "date_only": false, "value": "2026-10-09T20:39:09.767307Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bishopfox.bsky.social/post/3mxhtfkg2s62a", "record": "CVE-2026-28326", "field": "creation_timestamp", "uuid": "2c67735a-611d-4687-883b-fe8252474a6b", "content": "SolarWinds ARM shipped with a shared authentication secret.\n\nAn attacker who could reach TCP 55555 could bypass authentication and achieve SYSTEM-level RCE.\n\n@Jon Williams & the Bishop Fox TEA team reproduced CVE-2026-28326 and built a safe detector.\n\nThe 8.8 score? It depends on your firewall.", "url": "https://bsky.app/profile/bishopfox.bsky.social/post/3mxhtfkg2s62a"}]}