CVE-2024-28074: SolarWinds Access Rights Manager Auth Bypass

CVE-2024-28074 Overview

CVE-2024-28074 affects SolarWinds Access Rights Manager (ARM), an identity governance platform used to monitor and manage user access rights across enterprise environments. The vulnerability is an incomplete fix for a previously disclosed flaw. Researchers determined that the original patch introduced controls that could be bypassed using an alternative exploitation method. The weakness is classified under [CWE-502] Deserialization of Untrusted Data, allowing an adjacent-network attacker to trigger unsafe deserialization within the ARM service. Successful exploitation can result in remote code execution against the ARM host with high impact to confidentiality, integrity, and availability.

Critical Impact
An adjacent-network attacker can bypass prior mitigations and exploit unsafe deserialization in SolarWinds Access Rights Manager to execute arbitrary code on the ARM server.

Affected Products

SolarWinds Access Rights Manager (ARM) versions prior to 2024.3
Deployments exposing ARM services to adjacent network segments
Environments still running the previously patched but incompletely fixed release

Discovery Timeline

2024-07-17 - CVE-2024-28074 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28074

Vulnerability Analysis

CVE-2024-28074 originates from unsafe deserialization of untrusted data within SolarWinds Access Rights Manager. A previous vulnerability in the same code path was addressed, but the introduced controls did not fully constrain the deserialization pipeline. The researcher demonstrated an alternative path that reaches the same sink while bypassing the added validation logic.

Access Rights Manager processes serialized objects across internal service channels. When crafted payloads are supplied, the application reconstructs attacker-controlled object graphs without adequate type filtering. Reconstruction of these objects invokes gadget chains that lead to arbitrary command execution in the context of the ARM service account.

The EPSS score of 10.917% places this vulnerability in the 95th percentile for likelihood of exploitation attempts, reflecting the interest attackers show in SolarWinds infrastructure.

Root Cause

The root cause is [CWE-502] Deserialization of Untrusted Data. The original fix relied on allow-list or filter logic that did not cover all reachable deserialization sinks. The researcher identified a divergent method to submit a serialized payload that circumvented the filter and reached the vulnerable code path. Because ARM handles privileged operations, deserialization abuse translates directly into code execution with elevated privileges.

Attack Vector

The attack vector is Adjacent Network (AV:A). An attacker must have access to a network position that can reach the ARM service, such as the same broadcast domain, VPN segment, or logically adjacent VLAN. No authentication (PR:N) or user interaction (UI:N) is required. Once positioned, the attacker sends a serialized payload to the exposed ARM interface, triggering deserialization and gadget-chain execution.

No verified public proof-of-concept code has been released. The vulnerability mechanism is described in prose because no sanitized exploit code is available from authoritative sources. Consult the SolarWinds ARM Release Notes for vendor-supplied technical context.

Detection Methods for CVE-2024-28074

Indicators of Compromise

Unexpected child processes spawned by the SolarWinds ARM service account, particularly cmd.exe, powershell.exe, or script interpreters
Anomalous inbound connections to ARM service ports from adjacent network segments or non-administrative hosts
Newly created files or scheduled tasks on the ARM server outside of documented change windows
Outbound network connections from the ARM host to unfamiliar external endpoints following inbound traffic bursts

Detection Strategies

Monitor process lineage on ARM servers and alert on any non-standard child process of the ARM service executable
Inspect network flows for adjacent-network sources connecting to ARM management ports and correlate with authentication logs
Review Windows Event Logs for service crashes, unexpected .NET exceptions, or serialization errors that may indicate exploitation attempts

Monitoring Recommendations

Enable command-line auditing and PowerShell script block logging on all ARM hosts
Forward ARM application logs and Windows Security logs to a centralized SIEM for correlation
Establish a baseline of normal ARM service behavior and alert on statistical deviations in process, file, and network activity

How to Mitigate CVE-2024-28074

Immediate Actions Required

Upgrade SolarWinds Access Rights Manager to version 2024.3 or later, which contains the corrected fix
Restrict network access to ARM services so that only trusted administrative hosts can reach management interfaces
Audit ARM service accounts and rotate credentials if any indicators of compromise are observed
Review recent authentication and access-rights changes issued through ARM to identify unauthorized modifications

Patch Information

SolarWinds addressed CVE-2024-28074 in Access Rights Manager 2024.3. The updated release replaces the incomplete deserialization controls with corrected logic that closes the bypass identified by the researcher. Full remediation details are documented in the SolarWinds ARM 2024.3 Release Notes.

Workarounds

Segment ARM servers into a dedicated management VLAN with strict firewall rules limiting adjacent-network exposure
Require VPN or jump-host access for all administrative interactions with ARM services
Disable or block unused ARM listener ports at the host firewall until patching is complete

bash

# Example Windows Firewall rule to restrict ARM management access to a trusted admin subnet
New-NetFirewallRule -DisplayName "Restrict SolarWinds ARM Management" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 8081,8082 `
  -RemoteAddress 10.10.50.0/24 `
  -Action Allow