SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE

SolarWinds Access Rights Manager contained a hard-coded static cryptographic key — a fundamental secure development failure — that allowed any unauthenticated attacker to achieve remote code execution with a CVSS score of 8.8. Hard-coded credentials and keys are a well-known anti-pattern that bypass all authentication controls, effectively leaving a permanent backdoor built into the product itself. This is particularly dangerous in Access Rights Manager software, which is designed to control and audit privileged access across an organization, meaning a compromise could cascade into full environment takeover. The recurrence of critical CVEs across multiple SolarWinds products (ARM, Web Help Desk, Serv-U) highlights systemic secure development lifecycle (SDLC) gaps. Organizations relying on this software for privileged access governance face compounded risk if patching is delayed.