Company
SolarWinds is an IT management software vendor, making products like Observability, Access Rights Manager, and Web Help Desk.
SolarWinds launched Avior, a standalone AI agent for first-line IT work that holds anything it classes as potentially dangerous for human approval. The company says models decide what needs doing while a fixed, auditable framework controls how, so a rollout turns on where the vendor draws that line.
Reality
Consent phishing, the most common OAuth entry point according to SC World, leaves a victim tenant three audit events and no app registration record. Registration monitoring misses it, so the hunt moves to consent and delegated-grant operations in the defender's own logs.
Reality
SolarWinds fixed two pre-authentication RCEs in Observability Self-Hosted 2026.2.3, rated CVSS 9.8 and 8.8. Operators have no public detail to check either flaw's precondition against, so for most teams upgrading is the quickest way to know where a monitoring server stands.
Reality
Both Observability Self-Hosted flaws are remotely exploitable without authentication, and both depend on how the deployment was configured. The same researcher reported a third unauthenticated SolarWinds RCE a week earlier.
Reality
CVE-2026-28326 scores 8.8 and affects every build of Access Rights Manager up to 2026.2. The fix is ARM 2026.2.1, and it lands weeks after SolarWinds patched a SAML bypass in Web Help Desk and 16 flaws in Serv-U.
Reality
Richard Grabowski told a FedScoop-produced breakfast that CDM has to get faster and that responsible automation at scale is the route to it. The one interval he attached is a three-year roadmap for the program's SIEM service.
Reality
An SC Media commentary builds its case from Verizon's 2026 breach data, JPMorgan's patch arithmetic and Endor Labs dependency counts. Every figure reaches operators secondhand, and the ratio of disclosed to patched is the one that survives the discount.
Reality
The CTO of Dynatrace argues that agents cannot be trusted with production work inside systems that do not report on themselves, and he cites two 2026 surveys of enterprise visibility to size the problem.
Reality
A scan of 6,214 corporate domains found 120 sites whose AI-facing docs point at code packages and domains nobody owns, and registering a few of those names produced installs traced back to Claude, Codex and Hermes agents inside real networks.
Reality
Microsoft's Defender team cannot say which of three SolarWinds flaws opened the door, because the December hosts were vulnerable to all of them, which makes the exposure list more useful than the patch list.
Reality