cbcvebase.
CVE-2023-35182
published 2023-10-19

CVE-2023-35182: The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability can be abused by unauthenticated users on…

PriorityP267critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.38%
81.8th percentile
The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability can be abused by unauthenticated users on SolarWinds ARM Server.

Affected

2 ranges
VendorProductVersion rangeFixed in
solarwindsaccess_rights_manager<= 2023.2.0.73—
solarwindsaccess_rights_managerprevious versions – 2023.2.0.73—

Detection & IOCsextracted from sources · hover to see the quote

  • ·The vulnerability affects SolarWinds Access Rights Manager prior to version 2023.2.1; patched in 2023.2.1. Exploitation requires no authentication and results in SYSTEM-level code execution on the ARM Server. ↗
  • ·Exploitation is possible by unauthenticated remote attackers targeting the SolarWinds ARM Server directly — no prior foothold or credentials required. ↗
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.