CVE-2024-23476: The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this…

PriorityP265critical9.6CVSS 3.1

AVAACLPRNUINSCCHIHAH

EPSS

7.14%

93.5th percentile

The SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Directory Traversal Remote Code Execution Vulnerability. If exploited, this vulnerability allows an unauthenticated user to achieve the Remote Code Execution.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
solarwinds	access_rights_manager	< 2023.2.3	2023.2.3
solarwinds	access_rights_manager	previous versions – 2023.2.2	—

Detection & IOCsextracted from sources · hover to see the quote

→CVE-2024-23476 is a Directory Traversal (path traversal) weakness in SolarWinds Access Rights Manager (ARM) that enables unauthenticated Remote Code Execution — detection should focus on path traversal patterns in ARM HTTP/service traffic. ↗
→The vulnerability is exploitable by unauthenticated attackers, so monitor ARM endpoints for requests that do not carry valid authentication tokens but attempt directory traversal sequences (e.g., '../' or URL-encoded equivalents). ↗

·No in-the-wild exploitation has been reported by SolarWinds at the time of disclosure; however, the CVSS score is 9.6 Critical and exploitation requires no authentication, making rapid patching essential. ↗
·CVE-2024-23476 was reported by anonymous researchers via Trend Micro's Zero Day Initiative (ZDI); no public proof-of-concept exploit code is referenced in the available sources, limiting current signature-based detection options. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.