CVE-2024-23471: SolarWinds Access Rights Manager RCE Flaw

CVE-2024-23471 Overview

SolarWinds Access Rights Manager (ARM) contains a remote code execution vulnerability that allows an authenticated attacker on an adjacent network to abuse a SolarWinds service and execute arbitrary code on the host system. The flaw is tracked as an improper authentication issue [CWE-287] affecting versions of ARM prior to 2024.3.

Access Rights Manager is widely deployed in enterprise environments to govern permissions across Active Directory, file servers, Exchange, and SharePoint. Successful exploitation gives an attacker code execution in the context of the ARM service, exposing sensitive identity and access data.

Critical Impact
An authenticated adjacent-network attacker can achieve remote code execution on SolarWinds ARM servers, compromising a system that holds privileged access control data across Windows environments.

Affected Products

SolarWinds Access Rights Manager (ARM) versions prior to 2024.3
Deployments integrated with Active Directory, Exchange, and SharePoint
On-premises ARM installations reachable from adjacent network segments

Discovery Timeline

2024-07-17 - CVE-2024-23471 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-23471

Vulnerability Analysis

The vulnerability resides in a SolarWinds service exposed by Access Rights Manager. An authenticated user on an adjacent network can abuse the service to trigger execution of attacker-supplied code on the underlying host. The flaw is classified under [CWE-287], indicating that authentication or trust boundary enforcement within the affected service is insufficient to prevent misuse by low-privileged accounts.

Because ARM operates with elevated privileges to enumerate and modify access rights across Windows infrastructure, code execution on an ARM server translates to a foothold with broad reach into Active Directory and file system resources.

Root Cause

The root cause is improper authentication enforcement on a SolarWinds service method that performs privileged operations. The service accepts requests from authenticated principals without adequately validating whether the caller is authorized to invoke functionality that ultimately leads to code execution. Once the trust check is passed, unsafe input reaches an execution primitive on the server.

Attack Vector

Exploitation requires network adjacency (AV:A) and valid credentials for the ARM environment. An attacker on the same broadcast domain or logically adjacent network segment authenticates to the ARM service, then sends a crafted request that abuses the vulnerable method. The request causes the ARM service to execute attacker-controlled code with the service's privileges.

No public proof-of-concept exploit is currently listed, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. Detailed exploitation mechanics have not been published by SolarWinds; see the SolarWinds ARM 2024.3 Release Notes for vendor guidance.

Detection Methods for CVE-2024-23471

Indicators of Compromise

Unexpected child processes spawned by the ARM service account, particularly cmd.exe, powershell.exe, or scripting hosts launched from ARM binaries
Anomalous authenticated sessions to the ARM service originating from workstations that do not normally administer ARM
New or modified files in ARM installation directories or writes to temporary paths followed by execution

Detection Strategies

Monitor process lineage on ARM servers and alert when the ARM service parent spawns interactive shells or interpreters
Baseline network traffic to ARM service ports and flag connections from unusual source subnets on adjacent networks
Correlate authentication events to ARM with subsequent process creation and outbound network activity within a short time window

Monitoring Recommendations

Enable Windows process creation auditing (Event ID 4688) with command-line logging on all ARM hosts
Forward ARM application logs and Windows Security logs to a centralized platform such as Singularity Data Lake for retention and correlation
Track privileged group membership changes and permission modifications initiated from ARM systems following suspicious activity

How to Mitigate CVE-2024-23471

Immediate Actions Required

Upgrade SolarWinds Access Rights Manager to version 2024.3 or later, which contains the vendor fix
Restrict network access to ARM management interfaces to a dedicated administrative VLAN or jump host
Rotate credentials for accounts used by and integrated with ARM if compromise is suspected
Audit recent ARM activity logs for unexpected authenticated sessions and privileged operations

Patch Information

SolarWinds addressed CVE-2024-23471 in Access Rights Manager 2024.3. Refer to the SolarWinds ARM 2024.3 Release Notes for the complete list of resolved issues and upgrade instructions. Apply the update on all ARM servers and any dedicated collector or agent components in the deployment.

Workarounds

Segment the ARM server onto an isolated management network reachable only via authenticated jump hosts
Enforce strict host-based firewall rules limiting inbound access to ARM service ports to known administrator IP addresses
Disable or restrict ARM user accounts that are not actively required, and require multi-factor authentication for all remaining accounts

bash

# Example Windows Firewall rule limiting ARM service access to a management subnet
New-NetFirewallRule -DisplayName "Restrict SolarWinds ARM Service" \
  -Direction Inbound \
  -Program "C:\Program Files (x86)\SolarWinds\ARM\ARMService.exe" \
  -RemoteAddress 10.10.50.0/24 \
  -Action Allow