SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution…

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Checks whether SolarWinds Access Rights Manager is vulnerable to CVE-2026-28326.
.DESCRIPTION
    Detects installed ARM version via registry and file version info.
    Versions <= 2026.2 are VULNERABLE. Version 2026.2.1+ is PATCHED.
.OUTPUTS
    VULNERABLE, PATCHED, or UNKNOWN with exit codes 1, 0, 2 respectively.
#>

$ErrorActionPreference = 'Stop'

# Known registry paths for ARM installation
$regPaths = @(
    'HKLM:\SOFTWARE\SolarWinds\AccessRightsManager',
    'HKLM:\SOFTWARE\WOW6432Node\SolarWinds\AccessRightsManager',
    'HKLM:\SOFTWARE\SolarWinds\ARM'
)

$installPath = $null
$detectedVersion = $null

# Attempt registry detection
foreach ($rp in $regPaths) {
    if (Test-Path $rp) {
        try {
            $installPath = (Get-ItemProperty -Path $rp -ErrorAction SilentlyContinue).InstallPath
            $detectedVersion = (Get-ItemProperty -Path $rp -ErrorAction SilentlyContinue).Version
        } catch { }
        if ($installPath) { break }
    }
}

# Fallback: check common install directories
if (-not $installPath) {
    $commonPaths = @(
        "$env:ProgramFiles\SolarWinds\Access Rights Manager",
        "$env:ProgramFiles(x86)\SolarWinds\Access Rights Manager",
        "$env:ProgramFiles\SolarWinds\ARM"
    )
    foreach ($cp in $commonPaths) {
        if (Test-Path $cp) {
            $installPath = $cp
            break
        }
    }
}

# Check if ARM is installed
if (-not $installPath -or -not (Test-Path $installPath)) {
    Write-Host 'UNKNOWN - SolarWinds Access Rights Manager not detected on this host.'
    exit 2
}

Write-Host "ARM installation found at: $installPath"

# Try to get version from main executable
$exeCandidates = @(
    (Join-Path $installPath 'ARM.Server.exe'),
    (Join-Path $installPath 'SolarWinds.ARM.Server.exe'),
    (Join-Path $installPath 'AccessRightsManager.exe')
)

foreach ($exe in $exeCandidates) {
    if (Test-Path $exe) {
        try {
            $fileVer = (Get-Item $exe).VersionInfo.ProductVersion
            if ($fileVer) {
                $detectedVersion = $fileVer
                Write-Host "Detected version from binary: $fileVer"
                break
            }
        } catch { }
    }
}

if (-not $detectedVersion) {
    # Attempt to read version from any DLL in install path
    $dll = Get-ChildItem -Path $installPath -Filter 'SolarWinds.ARM*.dll' -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1
    if ($dll) {
        $detectedVersion = $dll.VersionInfo.ProductVersion
        Write-Host "Detected version from DLL: $detectedVersion"
    }
}

if (-not $detectedVersion) {
    Write-Host 'UNKNOWN - ARM installed but version could not be determined. Manual inspection required.'
    exit 2
}

Write-Host "ARM Version: $detectedVersion"

# Parse version for comparison
# Vulnerable: <= 2026.2 (i.e., 2026.2.0 and all prior)
# Patched:    >= 2026.2.1
try {
    # Normalize version string
    $cleanVer = $detectedVersion -replace '[^0-9.]', ''
    $parts = $cleanVer.Split('.')
    $major = [int]$parts[0]
    $minor = if ($parts.Count -ge 2) { [int]$parts[1] } else { 0 }
    $patch = if ($parts.Count -ge 3) { [int]$parts[2] } else { 0 }

    if ($major -lt 2026) {
        Write-Host "VULNERABLE - ARM $detectedVersion is below 2026.2.1. CVE-2026-28326 applies."
        exit 1
    } elseif ($major -eq 2026 -and $minor -lt 2) {
        Write-Host "VULNERABLE - ARM $detectedVersion is below 2026.2.1. CVE-2026-28326 applies."
        exit 1
    } elseif ($major -eq 2026 -and $minor -eq 2 -and $patch -lt 1) {
        Write-Host "VULNERABLE - ARM $detectedVersion is below 2026.2.1. CVE-2026-28326 applies."
        exit 1
    } elseif ($major -ge 2026 -and $minor -ge 2 -and $patch -ge 1) {
        Write-Host "PATCHED - ARM $detectedVersion is 2026.2.1 or later. CVE-2026-28326 is fixed."
        exit 0
    } else {
        Write-Host "PATCHED - ARM $detectedVersion appears to be at or above the fixed version."
        exit 0
    }
} catch {
    Write-Host "UNKNOWN - Could not parse version string '$detectedVersion'. Manual verification needed."
    exit 2
}