# Master Key Included: Detecting SolarWinds ARM CVE-2026-28326

Hardcoded HMAC key in SolarWinds ARM's gRPC listener on TCP 55555 lets unauthenticated remote attackers bypass auth and reach a BinaryFormatter sink, achieving SYSTEM RCE.

- Payout: Research
- Severity: high
- Program: SolarWinds
- Found by (vendor credit): Kai Huang from Armadin
- Write-up by: Kai Huang
- Disclosed: 2026-09-25
- CVE: CVE-2026-28326
- Write-up quality: 9/10
- Original: https://bishopfox.com/blog/detecting-solarwinds-arm-cve-2026-28326
- Library page: https://bugbountylibrary.com/r/blog%3Abishopfox-com-blog-detecting-solarwinds-arm-cve-2026-28326
- Tags: area:devices domain:desktop domain:network impact:rce kind:research platform:research sev:high tech:dotnet tech:grpc technique:source-review vuln:auth-bypass vuln:deserialization vuln:rce vuln:secrets-leak

**Target:** gRPC listener on TCP 55555 (.NET Remoting over HTTP/2)
**Root cause:** A fallback auth path accepts an HMAC token keyed by a secret shipped identically in every installer, with no locality check, on a listener bound to all interfaces; TLS only requests (not requires) client certs, so the app-layer check is the sole control before a BinaryFormatter deserialization sink.
**Steps:**
1. Reach TCP 55555; complete TLS anonymously since client cert is requested but not required (ALPN h2 needed).
2. Mint an HMAC token offline using the shipped config-file secret over the two caller-controlled request fields.
3. Send token in request header to pass the fallback auth gate; server adopts a registered client's cert thumbprint from its store (one already present on default install).
4. Open the duplex Remoting stream and send a BinaryFormatter payload evading the 27-regex denylist to reach the deserialization sink.
5. Achieve code execution as NT AUTHORITY\SYSTEM; confirm via HTTP callback and dropped file.
**How found:** Defender-side: decompiled and diffed 2026.2.0.42 vs 2026.2.1.7 (299 differing files, 19 with real code changes, 3 security-relevant), traced the fallback auth branch and the shipped secret, and noted the gRPC status code change (14 UNAVAILABLE to 16 UNAUTHENTICATED) enabling patch-state detection.
**Exploitation:** Unauthenticated attacker on the network reaches 55555, forges the HMAC token with the shipped key, passes the gate, and delivers a BinaryFormatter gadget payload over the Remoting stream, executing as LocalSystem. Validated in lab with OOB HTTP callback and file drop.
**Escalation:** Borrowed identity via adopting a registered client's cert thumbprint grants downstream authorization as that client; LocalSystem execution reaches outward through ARM's delegated AD/file/Exchange/SharePoint rights.
**Insight:** When a service claims mTLS, check whether the code requests vs requires client certs (one enum value); and treat any 'local-only' shared-secret auth path as remotely reachable if the listener binds all interfaces and no locality check exists.