CVE-2024-23470: SolarWinds Access Rights Manager RCE Flaw

CVE-2024-23470 Overview

CVE-2024-23470 is a pre-authentication remote code execution vulnerability in SolarWinds Access Rights Manager (ARM). The flaw allows an unauthenticated attacker on an adjacent network to run arbitrary commands and executables on the host. The weakness is categorized under [CWE-287] Improper Authentication. SolarWinds addressed the issue in ARM 2024.3.

Critical Impact
Unauthenticated attackers with adjacent network access can execute arbitrary commands on ARM servers, leading to full compromise of the identity governance platform.

Affected Products

SolarWinds Access Rights Manager versions prior to 2024.3
SolarWinds ARM Windows deployments exposing management services on the local network
Environments where ARM services are reachable from untrusted adjacent network segments

Discovery Timeline

2024-07-17 - CVE-2024-23470 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23470

Vulnerability Analysis

SolarWinds Access Rights Manager is an identity and access governance product used to audit and manage permissions across Active Directory, file servers, and Microsoft 365. CVE-2024-23470 exposes an authentication weakness that lets an attacker reach a sensitive code path without credentials.

A remote actor on the adjacent network can send crafted requests to an ARM service endpoint. The server processes the request and executes attacker-supplied commands or executables in the security context of the ARM service account. That account typically holds elevated Windows and directory privileges.

Exploitation yields full remote code execution, allowing lateral movement into the domains that ARM manages. Because ARM often runs with rights over Active Directory, successful exploitation can cascade into identity-wide compromise.

Root Cause

The root cause is improper authentication [CWE-287] on a service handler that accepts commands and executable invocations. The affected code path does not verify caller identity before dispatching the operation, so an unauthenticated request reaches privileged execution logic.

Attack Vector

The attack vector is adjacent network access with low complexity and no user interaction. An attacker who reaches the ARM host from the same broadcast domain, VLAN, or VPN segment can trigger the flaw directly. No prior credentials, phishing, or user action are required. Refer to the SolarWinds ARM 2024.3 Release Notes for vendor guidance.

No public exploit code or proof of concept is available at this time.

Detection Methods for CVE-2024-23470

Indicators of Compromise

Unexpected child processes spawned by the ARM service (ArmServer.exe or related binaries) such as cmd.exe, powershell.exe, or rundll32.exe
New scheduled tasks, services, or local accounts created on the ARM host without change-management records
Outbound connections from the ARM server to unknown external hosts following inbound traffic to ARM ports

Detection Strategies

Baseline process trees for the ARM service account and alert on any deviation involving shell interpreters or LOLBins
Inspect Windows Security and Sysmon logs (Event IDs 1, 4688, 7045) for anomalous process creation and service installation on ARM hosts
Correlate network flow data with process execution events to identify inbound adjacent-network sessions preceding command execution

Monitoring Recommendations

Enable command-line auditing and PowerShell script block logging on all ARM servers
Forward endpoint telemetry from ARM hosts to a centralized analytics platform for behavioral correlation
Monitor privileged directory changes performed by the ARM service account against an expected activity baseline

How to Mitigate CVE-2024-23470

Immediate Actions Required

Upgrade SolarWinds Access Rights Manager to version 2024.3 or later on all instances
Restrict network access to ARM management ports so only administrative jump hosts can reach the service
Audit the ARM service account for excess privileges and rotate credentials after patching

Patch Information

SolarWinds released a fix in Access Rights Manager 2024.3. Administrators should review the SolarWinds ARM 2024.3 Release Notes for upgrade steps and verify successful installation by checking the ARM version in the management console.

Workarounds

Place ARM servers on an isolated management VLAN with strict ingress firewall rules
Require VPN or bastion host access for any administrative connectivity to ARM
Disable or block ARM listening services on untrusted network interfaces until the patch is applied

bash

# Example Windows firewall rule to restrict ARM inbound access to an admin subnet
New-NetFirewallRule -DisplayName "ARM Admin Only" -Direction Inbound `
  -Program "C:\Program Files (x86)\SolarWinds\ARM\ArmServer.exe" `
  -RemoteAddress 10.10.50.0/24 -Action Allow

New-NetFirewallRule -DisplayName "ARM Block Other" -Direction Inbound `
  -Program "C:\Program Files (x86)\SolarWinds\ARM\ArmServer.exe" `
  -Action Block