Ingeniero de Seguridad: 2026-09-19

1. SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability (CVE-2026-28326)

   SolarWinds, 2026-09-17. Leer, 1 min.

   SolarWinds published an advisory for CVE-2026-28326, an unauthenticated remote code execution vulnerability in Access Rights Manager rated CVSS 8.8 that stems from a hardcoded static key. Access Rights Manager 2026.2 and all previous versions are affected, the fix is 2026.2.1, and the advisory makes no statement either way about exploitation.

   Por qué importa para este rol: You run the Access Rights Manager deployment, so plan the upgrade to 2026.2.1 and, until it lands, check what can reach the ARM service over the network. Because the key is hard-coded, rotating credentials changes nothing here; only the patched build does.

   Corrección del 2026-09-21: An earlier version said there was no evidence of exploitation and placed the fix in the normal patch cycle. The SolarWinds advisory makes no statement about exploitation either way. The item now cites the advisory itself instead of a news report about it.

2. Cisco Secure Firewall Adaptive Security Appliance, Secure Firewall Threat Defense, and Secure Firewall Management Center Software Hardening Release: September 2026

   Cisco (PSIRT), 2026-09-16. Leer, 6 min.

   Cisco published a hardening release covering eight vulnerabilities, CVE-2026-20329 through CVE-2026-20336, in Secure Firewall ASA, FTD and FMC software, found through internal security testing that Cisco says used its existing processes together with frontier AI models. For the vulnerabilities described in this advisory, Cisco states that PSIRT is not aware of any public announcements or malicious use. The advisory separately points readers to two other Firewall Management Center issues, a static credential vulnerability and an authentication bypass, each with its own advisory, which Cisco says are known to be actively exploited. There are no workarounds; Cisco directs customers to the fixed releases listed per branch.

   Por qué importa para este rol: Book the maintenance windows and set the failover order for upgrading ASA, FTD and FMC to the fixed branch releases, since no configuration change substitutes for the patch. While you are in Firewall Management Center, apply the separately advised static credential and authentication bypass fixes first.

Ingeniero de Seguridad