CVE-2024-23478: SolarWinds Access Rights Manager deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS 8.0 with adjacent-network, low-privilege, no-interaction RCE and a 99.6th percentile EPSS score makes this a high-priority patch despite no KEV listing.

What it is

SolarWinds Access Rights Manager contains a deserialization of untrusted data flaw (CWE-502) that lets an authenticated user abuse a SolarWinds service to achieve remote code execution. The vulnerability is rated CVSS 8.0 (High) and has a very high EPSS score, indicating elevated likelihood of exploitation activity.

Impact

An attacker who can authenticate can execute arbitrary code on the affected host, gaining full control of confidentiality, integrity and availability of the service and its data.

Attack surface

The vector is adjacent network (AV:A) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker must already hold valid credentials and be positioned on the same or an adjacent network segment to reach the vulnerable service.

Exploitation

The record shows no CISA KEV listing and no ransomware group usage, but EPSS is 0.81588 (99.6th percentile), and the only references are the vendor patch advisory, so exploitation is not confirmed in the supplied data.

What to do

• Apply the SolarWinds vendor patch for CVE-2024-23478 as soon as possible.
• Restrict network access to the ARM service so only trusted adjacent segments and hosts can reach it.
• Enforce least privilege and review which accounts hold the low-privileged access needed to reach the service.
• Monitor and alert on unexpected process creation or service behavior originating from the ARM host.
• If patching cannot be done immediately, isolate the ARM service from untrusted network segments.

Detection

• Hunt for unusual child processes spawned by SolarWinds ARM service processes.
• Monitor for deserialization-related errors or anomalous service requests in ARM logs.
• Alert on new or unexpected outbound connections from the ARM server.
• Review authentication logs for low-privileged accounts accessing the ARM service outside normal patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.