CVE-2024-23478CWE-502

SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution

High · published February 15, 2024

Patch now

High probability of exploitation

CVSS calls it high at 8.0. It sits in the 99.6th percentile for exploit probability.

CVSS v3.1
8.0
EPSS
82%
Percentile
99.6
In the wild
Unconfirmed
What it is

SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Remote Code Execution Vulnerability. If exploited, this vulnerability allows an authenticated user to abuse a SolarWinds service, resulting in remote code execution.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.81588 · 99.6th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2024-02-15T20:35Z
EPSS history
Timeline
  • 15 FEB 20:35Z
    SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution
    cvelistv5