IT Daily Roundup – September 21, 2026
1. SolarWinds Patches Access Rights Manager – Unauthenticated RCE via Hard-Coded Static Key
On September 19, SolarWinds released a patch for CVE-2026-28326 (CVSS 8.8) in its Access Rights Manager (ARM) product – a tool used for centralized management and auditing of access rights across Active Directory, servers, and applications. The vulnerability stems from a hard-coded static encryption key that allows an unauthenticated attacker to execute arbitrary code remotely on the server without any credentials. The fix is available in ARM 2026.2.1. SolarWinds has not reported active exploitation in the wild, but technical details are now publicly known, making the patching window short.
Why this matters: SolarWinds ARM is a tool used by IT departments and MSP providers to track and audit who has access to what – and it operates with elevated privileges in the corporate network. Unauthenticated RCE via a hard-coded key is among the most severe vulnerability types; an attacker only needs network reach to exploit it, with no credentials required. If you or your IT provider uses SolarWinds ARM, verify installation of version 2026.2.1 promptly. Also check whether the ARM console is accessible only from the internal network or via VPN, and not directly exposed to the internet.
2. CISA: Three Actively Exploited Linux Kernel Vulnerabilities – Patch Deadline Is Today
CISA has added three Linux kernel vulnerabilities with confirmed active exploitation to its Known Exploited Vulnerabilities (KEV) catalog, ordering federal agencies to patch by today, September 21. The most critical is CVE-2025-39682 (CVSS 9.8) – an improper condition check in the TLS receive path allowing memory disclosure or denial-of-service; CVE-2026-53266 (CVSS 8.8) is an out-of-bounds write in ebtables enabling local privilege escalation; CVE-2025-39964 (CVSS 7.8) is a race condition in AF_ALG sockets leading to system crashes or corruption of cryptographic operations. Red Hat confirmed active exploitation and recommended patching with the highest priority.
Why this matters: Linux servers are part of virtually every company's infrastructure today – web servers, databases, NAS devices, VPN concentrators, or cloud instances. A CVSS 9.8 score for a TLS vulnerability is exceptionally high, and combined with confirmed active exploitation, this is a genuinely urgent situation. Patching requires a kernel update and server restart – plan a brief maintenance window. For cloud servers (AWS, Azure, GCP), verify OS image currency or use a patch management solution (e.g., AWS Systems Manager Patch Manager). This is also a good moment to assess whether your Linux servers are under a regular patch management regime – or simply "running and untouched."
3. North Korean WaterPlum Hackers Infected 30,000 Devices via Fake Job Interviews
Security researchers have documented a large-scale campaign by WaterPlum – a North Korean threat group linked to the 313th General Bureau overseeing weapons research – that infected at least 30,000 devices across more than 100 countries. The attack technique, known as "Contagious Interview," works as follows: hackers pose as recruiters from AI, cryptocurrency, or NFT companies and approach job seekers through professional platforms. During a fake online interview, victims are asked to download and run a project – an npm package or a Visual Studio Code project – under the guise of a technical assessment. The project contains malware that infects the device and allows attackers to pivot through the compromised endpoint into the victim's employer's internal network.
← All postsWhy this matters: This technique targets primarily developers and IT professionals – people who routinely run unfamiliar code on their work laptops. For an SME, there are two distinct risks: (1) your employee is quietly looking for a new job and infects the company laptop while running a "test project" sent by a fake recruiter; and (2) you are hiring a new IT employee or freelancer and the attacker applies as a candidate, sending you malicious code "as a work sample." The recommendations are practical: always run candidate test code in an isolated sandbox (a VM or Docker container with no network access), brief your staff on this technique, and establish a clear policy against using company devices for personal job searches.