SolarWinds Access Rights Manager (ARM) Systemic Deserialization RCE — 17 CVEs, 6 Unauth SYSTEM RCE, Access Control Paradox
SolarWinds Access Rights Manager (ARM) Systemic (TL-2026-0016), also tracked as telnetd auth bypass, is a critical-severity software vulnerability, first published 2026-02-02. It has no confirmed attribution, affects GNU InetUtils, references 1 CVE (CVE-2026-24061), maps to 38 MITRE ATT&CK techniques (T1003, T1005, T1021), and is covered by 9 detection rules and 65 indicators of compromise.
Key facts for TL-2026-0016
- Threat ID
- TL-2026-0016
- Also known as
- telnetd auth bypass, inetutils argument injection
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-02-02
- Last reviewed
- 2026-02-02
- Attribution confidence
- NONE
- Motivation
- EXPLOITATION
- Target sectors
- Government, Financial Services, Healthcare, Technology, Critical Infrastructure, Defense, Education
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 65
SolarWinds Access Rights Manager (ARM) contains a systemic pattern of critical deserialization, directory traversal, and remote code execution vulnerabilities — 16+ CVEs disclosed between May 2024 and September 2024, with 8 rated CVSS 9.0+ (Critical) including 6 enabling unauthenticated SYSTEM-level remote code execution. The vulnerabilities were primarily discovered by Piotr Bazydlo (@chudypb) and anonymous researchers through Trend Micro's Zero Day Initiative (ZDI), revealing fundamental architectural flaws in ARM's .NET deserialization handling, file system operations, and authentication mechanisms. ARM is used by enterprises to manage Active Directory permissions, file server access rights, and compliance auditing — making it a high-value target where compromise grants attackers direct control over organizational access control infrastructure. The vulnerability cluster spans three major patch cycles (ARM 2024.3, 2024.3.1, and 2024.3.1 SR) with one CVE (CVE-2024-28074) being a bypass of a previous incomplete fix. This product sits within the SolarWinds ecosystem, which was the vector for the catastrophic SUNBURST supply chain attack (2020) by Russian SVR (APT29/Cozy Bear), making any SolarWinds product vulnerability carry elevated strategic risk due to the proven nation-state interest in this vendor's software.
How SolarWinds Access Rights Manager (ARM) Systemic works
SolarWinds Access Rights Manager (ARM) is an enterprise tool for managing, auditing, and provisioning access rights across Active Directory, Exchange, SharePoint, file servers, and other Windows infrastructure. Organizations use ARM to answer critical compliance questions: 'Who has access to what?' and 'Who changed what permissions?' ARM sits at the CENTER of the access control infrastructure — it has read and write access to Active Directory permissions, file server ACLs, and group memberships across the entire organization.
**THE VULNERABILITY LANDSCAPE — 16+ CVEs IN 5 MONTHS:**
Between May and September 2024, SolarWinds disclosed 16+ vulnerabilities in ARM across three patch cycles, representing one of the densest vulnerability clusters for a single enterprise product:
**July 17, 2024 — ARM 2024.3 (Mega-Patch: 13 CVEs):**
1. **CVE-2024-28074** (CVSS 9.6, Critical) — Internal Deserialization RCE. BYPASS of a previous incomplete fix. An anonymous ZDI researcher found that controls implemented for an earlier deserialization vulnerability could be circumvented using a different exploitation method. This is the CORE vulnerability for TL-2026-0016: .NET deserialization of untrusted data enabling unauthenticated remote code execution.
2. **CVE-2024-23469** (CVSS 9.6, Critical) — Exposed Dangerous Method RCE. Allows unauthenticated user to perform actions with SYSTEM privileges. Discovered by Piotr Bazydlo (@chudypb) of ZDI.
3. **CVE-2024-23470** (CVSS 9.6, Critical) — UserScriptHumster Exposed Dangerous Method. Pre-authentication remote command execution — unauthenticated user can run arbitrary commands and executables.
4. **CVE-2024-23471** (CVSS 9.6, Critical) — CreateFile Directory Traversal RCE. Authenticated user can abuse SolarWinds service for remote code execution.
5. **CVE-2024-23466** (CVSS 9.6, Critical) — Directory Traversal RCE. Unauthenticated user can perform remote code execution.
6. **CVE-2024-23475** (CVSS 9.6, Critical) — Directory Traversal and Information Disclosure. Unauthenticated arbitrary file deletion and sensitive information leakage.
7. **CVE-2024-23472** (CVSS 9.6, Critical) — Directory Traversal Arbitrary File Deletion and Information Disclosure.
8. **CVE-2024-23467** (CVSS 9.6, Critical) — Directory Traversal and Information Disclosure enabling RCE.
9. **CVE-2024-23465** (CVSS 8.3, High) — ChangeHumster Exposed Dangerous Method Authentication Bypass.
10. **CVE-2024-28992** (CVSS 7.6, High) — Traversal and Information Disclosure.
11. **CVE-2024-28993** (CVSS 7.6, High) — Traversal and Information Disclosure.
12. **CVE-2024-23468** (CVSS 7.6, High) — Traversal and Information Disclosure.
13. **CVE-2024-23474** (CVSS 7.6, High) — deleteTransferFile Directory Traversal, Arbitrary File Deletion and Information Disclosure.
**May 9, 2024 — ARM 2023.2.4 Patch:**
14. **CVE-2024-28075** (CVSS 9.0, Critical) — Deserialization of Untrusted Data RCE. The ORIGINAL deserialization vulnerability that CVE-2024-28074 later bypassed.
15. **CVE-2024-23473** (CVSS 8.6, High) — Hard-Coded Credentials Authentication Bypass.
**September 12, 2024 — ARM 2024.3.1:**
16. **CVE-2024-28991** (CVSS 9.0, Critical) — Deserialization of Untrusted Data RCE. ANOTHER deserialization RCE after the two previous patches. Authenticated user can abuse the service for remote code execution. Discovered by Piotr Bazydlo (@chudypb) of ZDI.
17. **CVE-2024-28990** (CVSS 6.3, Medium) — Hardcoded Credentials Authentication Bypass.
**THE PATTERN — SYSTEMIC ARCHITECTURAL FAILURE:**
The ARM vulnerability cluster reveals SYSTEMIC problems, not isolated bugs:
1. **Deserialization is fundamentally broken**: Three separate deserialization RCE CVEs (CVE-2024-28075, CVE-2024-28074, CVE-2024-28991) across three patch cycles. The second was explicitly a bypass of the first fix. The vendor cannot eliminate the deserialization attack surface — it keeps resurfacing.
2. **Directory traversal is pervasive**: 7+ CVEs for directory traversal alone, spanning file creation, file deletion, information disclosure, and remote code execution. The application's file system operations lack consistent input validation.
3. **Authentication is weak**: Hard-coded credentials (CVE-2024-23473, CVE-2024-28990) and authentication bypass (CVE-2024-23465) across multiple versions. Credentials baked into the application that persist across versions.
4. **Dangerous methods are exposed**: Multiple 'Exposed Dangerous Method' CVEs (CVE-2024-23469, CVE-2024-23470) allowing unauthenticated SYSTEM-level execution. The application exposes internal functionality to network-accessible interfaces without authorization checks.
5. **Incomplete fixes recur**: CVE-2024-28074 explicitly states it bypasses controls implemented for a previous vulnerability. This suggests patch-and-pray development rather than root cause analysis.
**SOLARWINDS SUPPLY CHAIN CONTEXT — SUNBURST:**
Any SolarWinds product vulnerability carries elevated strategic risk because of the 2020 SUNBURST supply chain attack:
- Russian SVR (APT29/Cozy Bear) compromised SolarWinds Orion build process - Trojanized updates delivered to ~18,000 organizations - 9 US federal agencies breached including Treasury, Commerce, DHS, State - FireEye (now Mandiant) discovered the attack after their own breach - Estimated $100B+ total cost across government and private sector - The attack demonstrated that IT management tools are APEX targets — they have broad network access, elevated privileges, and are trusted by security tools
ARM is not Orion, but it's the SAME VENDOR, the SAME customer base, and operates with the SAME elevated trust in enterprise environments. Nation-state actors who successfully targeted SolarWinds once have demonstrated interest in this vendor's products as attack vectors.
**THE ACCESS CONTROL PARADOX:**
ARM manages WHO CAN ACCESS WHAT across the entire organization. Compromising ARM doesn't just give you access — it gives you the ability to GRANT yourself access to everything, REVOKE access from defenders, and HIDE your permission changes in the audit logs that ARM itself controls. The tool designed to enforce access control becomes the tool that subverts it.
MITRE ATT&CK techniques used in TL-2026-0016
credential-access
T1003 OS Credential Dumping; T1552 Unsecured Credentials; T1555 Credentials from Password Stores; T1556 Modify Authentication Process; T1558 Steal or Forge Kerberos Tickets
collection
T1005 Data from Local System; T1114 Email Collection; T1213 Data from Information Repositories
lateral-movement
defense-evasion
T1036 Masquerading; T1070 Indicator Removal; T1078 Valid Accounts; T1134 Access Token Manipulation; T1211 Exploitation for Stealth; T1550 Use Alternate Authentication Material
exfiltration
T1041 Exfiltration Over C2 Channel
discovery
T1046 Network Service Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1482 Domain Trust Discovery; T1615 Group Policy Discovery
execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1569 System Services
privilege-escalation
T1068 Exploitation for Privilege Escalation
persistence
T1098 Account Manipulation; T1133 External Remote Services; T1136 Create Account; T1505 Server Software Component; T1547 Boot or Logon Autostart Execution
initial-access
T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise
impact
T1485 Data Destruction; T1491 Defacement; T1531 Account Access Removal
reconnaissance
T1591 Gather Victim Org Information
defense-impairment
Affected products and versions in SolarWinds Access Rights Manager (ARM) Systemic
- GNU — InetUtils
Vulnerable versions: All versions before patch
Fixed in: Patched versions (see codeberg commits) - Debian — inetutils-telnetd
Vulnerable versions: All unpatched versions
Fixed in: See debian-lts-announce
Remediation for SolarWinds Access Rights Manager (ARM) Systemic
Patches
- ARM 2024.3 — Fixes 13 CVEs including 6 critical unauthenticated RCE (July 17, 2024)
- ARM 2024.3.1 — Fixes CVE-2024-28991 (deserialization RCE) and CVE-2024-28990 (hardcoded creds) (September 12, 2024)
- ARM 2024.3.1 SR — Latest service release
Immediate actions
- PATCH IMMEDIATELY: Upgrade SolarWinds ARM to version 2024.3.1 SR (latest). Versions prior to 2024.3 contain 6 UNAUTHENTICATED SYSTEM-level RCE vulnerabilities. This is not a routine patch — it is an emergency remediation for pre-auth RCE.
- NETWORK ISOLATION: Until patching is confirmed, isolate ARM servers from all non-essential network access. ARM should ONLY be accessible from dedicated management workstations. Block all inbound access from user networks and the internet.
- AUDIT ARM ACTIVITY: Review ARM server logs for any signs of exploitation — unexpected process creation, file system modifications, new user accounts, or permission changes. Attackers gaining SYSTEM access via these vulnerabilities can modify Active Directory permissions silently.
- CREDENTIAL ROTATION: Rotate ALL credentials used by ARM for Active Directory integration, file server access, and database connections. Hard-coded credentials (CVE-2024-23473, CVE-2024-28990) may have been extracted and used for persistence.
- VERIFY ACTIVE DIRECTORY INTEGRITY: Compare current AD group memberships, OU delegations, and GPO assignments against known-good baselines. An attacker who compromised ARM could have granted themselves persistent admin access through AD permission modifications.
Workarounds
- If unable to patch immediately: restrict network access to ARM server to management-only VLAN with jump server access only
- Disable any ARM web interfaces exposed to non-admin networks
- Implement network-level monitoring for exploitation indicators: unusual .NET deserialization payloads, directory traversal patterns (../../), command execution from ARM process
Longer-term hardening
- MANAGEMENT TOOL SECURITY ARCHITECTURE: Treat ARM and all IT management tools as TIER ZERO infrastructure — same security tier as domain controllers. Dedicated management networks, jump servers, hardware MFA, continuous monitoring. The SUNBURST lesson: management tools with broad access are the highest-value targets.
- DEFENSE IN DEPTH FOR ACCESS CONTROL: Do not rely on a single tool (ARM) as the sole source of truth for access rights. Implement independent monitoring of AD permissions, file server ACLs, and group memberships that does NOT depend on ARM. If ARM is compromised, you need an independent detection capability.
- VENDOR RISK ASSESSMENT: SolarWinds has demonstrated a pattern of systemic vulnerabilities across multiple products (ARM, Web Help Desk, Orion, Serv-U, Platform). Evaluate whether the organizational risk of running SolarWinds products is acceptable given the vendor's security track record. Consider alternative access rights management solutions.
- DESERIALIZATION HARDENING: If continuing to use ARM, implement network-level controls that restrict which endpoints can communicate with ARM services. Use application-aware firewalls or WAFs to inspect and filter serialized data payloads.
- CONTINUOUS VULNERABILITY MONITORING: Subscribe to SolarWinds Trust Center advisories and ZDI published advisories. ARM vulnerabilities are discovered primarily through ZDI — new disclosures should trigger immediate assessment.
CVEs associated with SolarWinds Access Rights Manager (ARM) Systemic
Weaknesses (CWE) in SolarWinds Access Rights Manager (ARM) Systemic
CWE-88, CWE-287
Timeline of SolarWinds Access Rights Manager (ARM) Systemic
- SolarWinds Orion supply chain compromised by Russian SVR (APT29/Cozy Bear). Trojanized updates (SUNBURST backdoor) delivered to ~18,000 organizations including 9 US federal agencies. Estimated $100B+ impact. Establishes SolarWinds products as proven nation-state targets. Any vulnerability in SolarWinds products carries elevated strategic risk. Source: CISA Emergency Directive 21-01.
- Trend Micro Zero Day Initiative (ZDI) researchers begin systematic security assessment of SolarWinds Access Rights Manager. Piotr Bazydlo (@chudypb) and anonymous researchers identify multiple critical vulnerability classes: deserialization of untrusted data, directory traversal, exposed dangerous methods, and hardcoded credentials. Research would yield 16+ CVEs over the following year.
- SolarWinds discloses first ARM vulnerability batch: CVE-2024-28075 (CVSS 9.0, deserialization RCE) and CVE-2024-23473 (CVSS 8.6, hardcoded credentials auth bypass). Fixed in ARM 2023.2.4. The deserialization vulnerability (CVE-2024-28075) would later be found to have an incomplete fix. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28075
- SolarWinds releases ARM 2024.3 fixing 13 CVEs simultaneously — the largest single-product security patch in SolarWinds history. Includes 6 critical unauthenticated SYSTEM-level RCE vulnerabilities (CVE-2024-28074, CVE-2024-23469, CVE-2024-23470, CVE-2024-23466, CVE-2024-23467, CVE-2024-23475). CVE-2024-28074 is explicitly a BYPASS of the CVE-2024-28075 fix from May. All discovered via ZDI. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28074
- SolarWinds releases ARM 2024.3.1 fixing CVE-2024-28991 (CVSS 9.0, deserialization RCE) and CVE-2024-28990 (CVSS 6.3, hardcoded credentials). This is the THIRD deserialization RCE patch in 4 months, demonstrating the attack surface cannot be fully eliminated with point fixes. Discovered by Piotr Bazydlo (@chudypb) of ZDI. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28991
- SolarWinds discloses CVE-2024-28988 (CVSS 9.8, Web Help Desk Java deserialization RCE) — demonstrating that deserialization vulnerabilities are SYSTEMIC across SolarWinds products, not isolated to ARM. Web Help Desk would go on to have 5+ more critical CVEs through 2026 including CVE-2025-40551 (added to CISA KEV Feb 2026). The deserialization problem is architectural across the SolarWinds ecosystem.
- SolarWinds discloses 5 new Web Help Desk CVEs (4 Critical, 1 High) including CVE-2025-40551 (deserialization RCE, CVSS 9.8) and CVE-2025-40552 (auth bypass, CVSS 9.8). CVE-2025-40551 added to CISA Known Exploited Vulnerabilities catalog Feb 3, 2026. Demonstrates continuing pattern of critical vulnerabilities across SolarWinds product line.
- CISA adds SolarWinds Web Help Desk CVE-2025-40551 (deserialization RCE) to Known Exploited Vulnerabilities catalog with 3-day remediation deadline (due Feb 6, 2026). Confirms active exploitation in the wild of SolarWinds deserialization vulnerabilities. While this is WHD not ARM, it validates that SolarWinds deserialization flaws ARE being exploited by threat actors.
- Revalidation assessment: SolarWinds ARM remains a HIGH-RISK product. The deserialization attack surface has required 3+ patches and persists architecturally. The broader SolarWinds ecosystem shows the same vulnerability patterns across ARM, Web Help Desk, Serv-U, and Platform products. Combined with the SUNBURST supply chain precedent, organizations running SolarWinds ARM should treat it as Tier Zero critical infrastructure requiring maximum security controls — or evaluate alternative solutions.
- As of 2026-05-29, this threat (identifiers.cve=CVE-2026-24061, GNU InetUtils telnetd auth-bypass/argument-injection, CVSS 9.8) is still active: it is in CISA KEV (added 2026-01-26) and under ongoing in-the-wild exploitation (waves since 2026-01-22, actor 'rwxrwx'). Despite an available patch (InetUtils >2.7), ~221k telnet hosts remain exposed and GreyNoise still observes active exploitation.
Sources cited for SolarWinds Access Rights Manager (ARM) Systemic
- SolarWinds Advisory — CVE-2024-28074 (ARM Internal Deserialization RCE, CVSS 9.6)
- SolarWinds Advisory — CVE-2024-28075 (ARM Deserialization RCE, CVSS 9.0)
- SolarWinds Advisory — CVE-2024-28991 (ARM Deserialization RCE, CVSS 9.0)
- SolarWinds Advisory — CVE-2024-23469 (ARM Exposed Dangerous Method RCE, CVSS 9.6)
- SolarWinds Advisory — CVE-2024-23470 (ARM UserScriptHumster Pre-Auth RCE, CVSS 9.6)
- SolarWinds Advisory — CVE-2024-23466 (ARM Directory Traversal RCE, CVSS 9.6)
- SolarWinds Advisory — CVE-2024-23475 (ARM Directory Traversal File Delete + Info Disclosure, CVSS 9.6)
- SolarWinds Trust Center — Full Security Advisory Catalog
- SolarWinds ARM 2024.3 Release Notes
- SolarWinds ARM 2024.3.1 Release Notes
More in vulnerability
- CVE-2025-59201: Windows Network Connection Status Indicator (NCSI) Elevation of Privilege via Registry Symbolic Link Abuse
- CVE-2026-20817: Windows Error Reporting Service (WerSvc.dll) Local Privilege Escalation via ALPC Argument Injection
- Sudo iptables NOPASSWD Misconfiguration Enables Local Privilege Escalation via Comment Injection
- CVE-2025-37947: Out-of-Bounds Write in Linux ksmbd Kernel SMB Server Enables Local Privilege Escalation
- Dell ObjectScale Critical Deserialization Flaw (CVE-2026-70416, CVSS 10.0) Enables Unauthenticated RCE
Detection coverage for TL-2026-0016
As of 2026-02-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0016 across Splunk SPL, Microsoft KQL and Sigma, covering 65 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.