SolarWinds Access Rights Manager (ARM) Systemic Deserialization RCE — 17 CVEs, 6 Unauth SYSTEM RCE, Access Control Paradox

Key facts for SolarWinds ARM deserialization RCE

Detection coverage for SolarWinds ARM deserialization RCE

As of 2026-02-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0016 across Splunk SPL, Microsoft KQL and Sigma, covering 65 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SolarWinds ARM Service Spawning Unexpected Child Process — Deserialization RCE Exploitation

Detects unexpected child process creation by the SolarWinds Access Rights Manager service processes (SolarWindsARM.exe, ARMService.exe, SolarWinds.ARM.WebAPI.exe). Successful exploitation of deserialization vulnerabilities (CVE-2024-28074, CVE-2024-28075, CVE-2024-28991) or exposed dangerous methods (CVE-2024-23469, CVE-2024-23470) yields SYSTEM-level code execution, which manifests as the ARM service spawning cmd.exe, powershell.exe, or other executables. ARM processes should ONLY spawn known ARM child processes — any other child process is a strong exploitation indicator requiring immediate incident response.

• Language: Splunk SPL
• ATT&CK: T1190, T1059.001, T1059.003, T1068
• Data sources: sysmon, windows_security, edr_telemetry
• Severity: critical
• Confidence: high

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| search ParentImage IN ("*\\SolarWindsARM.exe", "*\\ARMService.exe", "*\\SolarWinds.ARM.WebAPI.exe", "*\\SolarWinds.ARM.BusinessLayer.exe", "*\\w3wp.exe")
| eval is_arm_child=if(match(Image, "(?i)(SolarWinds|ARM|dotnet|conhost)"), "expected", "unexpected")
| where is_arm_child="unexpected"
| eval severity=case(
    match(Image, "(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|certutil\.exe|bitsadmin\.exe)"), "CRITICAL — command interpreter from ARM service (active exploitation)",
    match(Image, "(?i)(net\.exe|net1\.exe|dsadd\.exe|dsmod\.exe|dsget\.exe|csvde\.exe|ldifde\.exe)"), "CRITICAL — AD management tool from ARM (persistence attempt)",
    match(Image, "(?i)(whoami\.exe|ipconfig\.exe|systeminfo\.exe|nltest\.exe|tasklist\.exe)"), "HIGH — reconnaissance from ARM service",
    match(Image, "(?i)(procdump|mimikatz|rubeus|sharphound)"), "CRITICAL — offensive tool from ARM service",
    1=1, "HIGH — unknown process from ARM service")
| table _time host ParentImage Image CommandLine User severity
| sort -severity -_time

Known false positives:

• ARM legitimate update processes — whitelist specific ARM updater executables and verify digital signatures. ARM diagnostic utilities — document and whitelist approved diagnostic tools. IIS worker process (w3wp.exe) spawning legitimate ARM components — baseline normal w3wp child processes for the ARM application pool.

Tuning notes: Sysmon Event ID 1 (ProcessCreate) provides the most reliable parent-child process telemetry. For w3wp.exe parent filtering, restrict to the specific IIS application pool running ARM (AppPool name in CommandLine). The CRITICAL severity for cmd.exe/powershell.exe from ARM is high-confidence — ARM services should NEVER spawn interactive shells. Consider automated response: kill the child process and isolate the ARM server from the network when this fires.

• 🔒 .NET Deserialization Payload in ARM Network Traffic — BinaryFormatter Exploitation · unlock with TL Creds
• 🔒 DCSync Replication Request from SolarWinds ARM Server — Credential Theft Post-Exploitation · unlock with TL Creds
• 🔒 SolarWinds ARM Audit Log Tampering or Gap — Evidence Destruction Post-Exploitation · unlock with TL Creds
• 🔒 SolarWinds ARM Exposed Method Access — UserScriptHumster/ChangeHumster Pre-Auth Exploitation · unlock with TL Creds
• 🔒 LSASS Memory Access from SolarWinds ARM Server Process — Credential Dumping Post-Exploitation · unlock with TL Creds
• 🔒 Lateral Movement from SolarWinds ARM Server — SMB Admin Share and WinRM Post-Exploitation · unlock with TL Creds
• 🔒 Active Directory Privileged Group Modification from ARM Server — Post-Exploitation Persistence · unlock with TL Creds
• 🔒 Directory Traversal Pattern in ARM Web Service Requests — Path Traversal Exploitation · unlock with TL Creds

Indicators of compromise for SolarWinds ARM deserialization RCE

As of 2026-02-02, Threadlinqs Intelligence tracks 65 indicators of compromise for TL-2026-0016.

How SolarWinds ARM deserialization RCE works

The vulnerabilities were primarily discovered by Piotr Bazydlo (@chudypb) and anonymous researchers through Trend Micro's Zero Day Initiative (ZDI), revealing fundamental architectural flaws in ARM's .NET deserialization handling, file system operations, and authentication mechanisms. ARM is used by enterprises to manage Active Directory permissions, file server access rights, and compliance auditing — making it a high-value target where compromise grants attackers direct control over organizational access control infrastructure. The vulnerability cluster spans three major patch cycles (ARM 2024.3, 2024.3.1, and 2024.3.1 SR) with one CVE (CVE-2024-28074) being a bypass of a previous incomplete fix. This product sits within the SolarWinds ecosystem, which was the vector for the catastrophic SUNBURST supply chain attack (2020) by Russian SVR (APT29/Cozy Bear), making any SolarWinds product vulnerability carry elevated strategic risk due to the proven nation-state interest in this vendor's software.

SolarWinds Access Rights Manager (ARM) is an enterprise tool for managing, auditing, and provisioning access rights across Active Directory, Exchange, SharePoint, file servers, and other Windows infrastructure. Organizations use ARM to answer critical compliance questions: 'Who has access to what?' and 'Who changed what permissions?' ARM sits at the CENTER of the access control infrastructure — it has read and write access to Active Directory permissions, file server ACLs, and group memberships across the entire organization.

**THE VULNERABILITY LANDSCAPE — 16+ CVEs IN 5 MONTHS:**

Between May and September 2024, SolarWinds disclosed 16+ vulnerabilities in ARM across three patch cycles, representing one of the densest vulnerability clusters for a single enterprise product:

**July 17, 2024 — ARM 2024.3 (Mega-Patch: 13 CVEs):**

1. **CVE-2024-28074** (CVSS 9.6, Critical) — Internal Deserialization RCE. BYPASS of a previous incomplete fix. An anonymous ZDI researcher found that controls implemented for an earlier deserialization vulnerability could be circumvented using a different exploitation method. This is the CORE vulnerability for TL-2026-0016: .NET deserialization of untrusted data enabling unauthenticated remote code execution.

2. **CVE-2024-23469** (CVSS 9.6, Critical) — Exposed Dangerous Method RCE. Allows unauthenticated user to perform actions with SYSTEM privileges. Discovered by Piotr Bazydlo (@chudypb) of ZDI.

3. **CVE-2024-23470** (CVSS 9.6, Critical) — UserScriptHumster Exposed Dangerous Method. Pre-authentication remote command execution — unauthenticated user can run arbitrary commands and executables.

4. **CVE-2024-23471** (CVSS 9.6, Critical) — CreateFile Directory Traversal RCE. Authenticated user can abuse SolarWinds service for remote code execution.

5. **CVE-2024-23466** (CVSS 9.6, Critical) — Directory Traversal RCE. Unauthenticated user can perform remote code execution.

6. **CVE-2024-23475** (CVSS 9.6, Critical) — Directory Traversal and Information Disclosure. Unauthenticated arbitrary file deletion and sensitive information leakage.

7. **CVE-2024-23472** (CVSS 9.6, Critical) — Directory Traversal Arbitrary File Deletion and Information Disclosure.

8. **CVE-2024-23467** (CVSS 9.6, Critical) — Directory Traversal and Information Disclosure enabling RCE.

9. **CVE-2024-23465** (CVSS 8.3, High) — ChangeHumster Exposed Dangerous Method Authentication Bypass.

10. **CVE-2024-28992** (CVSS 7.6, High) — Traversal and Information Disclosure.

11. **CVE-2024-28993** (CVSS 7.6, High) — Traversal and Information Disclosure.

12. **CVE-2024-23468** (CVSS 7.6, High) — Traversal and Information Disclosure.

13. **CVE-2024-23474** (CVSS 7.6, High) — deleteTransferFile Directory Traversal, Arbitrary File Deletion and Information Disclosure.

**May 9, 2024 — ARM 2023.2.4 Patch:**

14. **CVE-2024-28075** (CVSS 9.0, Critical) — Deserialization of Untrusted Data RCE. The ORIGINAL deserialization vulnerability that CVE-2024-28074 later bypassed.

15. **CVE-2024-23473** (CVSS 8.6, High) — Hard-Coded Credentials Authentication Bypass.

**September 12, 2024 — ARM 2024.3.1:**

16. **CVE-2024-28991** (CVSS 9.0, Critical) — Deserialization of Untrusted Data RCE. ANOTHER deserialization RCE after the two previous patches. Authenticated user can abuse the service for remote code execution. Discovered by Piotr Bazydlo (@chudypb) of ZDI.

17. **CVE-2024-28990** (CVSS 6.3, Medium) — Hardcoded Credentials Authentication Bypass.

**THE PATTERN — SYSTEMIC ARCHITECTURAL FAILURE:**

The ARM vulnerability cluster reveals SYSTEMIC problems, not isolated bugs:

1. **Deserialization is fundamentally broken**: Three separate deserialization RCE CVEs (CVE-2024-28075, CVE-2024-28074, CVE-2024-28991) across three patch cycles. The second was explicitly a bypass of the first fix. The vendor cannot eliminate the deserialization attack surface — it keeps resurfacing.

2. **Directory traversal is pervasive**: 7+ CVEs for directory traversal alone, spanning file creation, file deletion, information disclosure, and remote code execution. The application's file system operations lack consistent input validation.

3. **Authentication is weak**: Hard-coded credentials (CVE-2024-23473, CVE-2024-28990) and authentication bypass (CVE-2024-23465) across multiple versions. Credentials baked into the application that persist across versions.

4. **Dangerous methods are exposed**: Multiple 'Exposed Dangerous Method' CVEs (CVE-2024-23469, CVE-2024-23470) allowing unauthenticated SYSTEM-level execution. The application exposes internal functionality to network-accessible interfaces without authorization checks.

5. **Incomplete fixes recur**: CVE-2024-28074 explicitly states it bypasses controls implemented for a previous vulnerability. This suggests patch-and-pray development rather than root cause analysis.

**SOLARWINDS SUPPLY CHAIN CONTEXT — SUNBURST:**

Any SolarWinds product vulnerability carries elevated strategic risk because of the 2020 SUNBURST supply chain attack:

- Russian SVR (APT29/Cozy Bear) compromised SolarWinds Orion build process - Trojanized updates delivered to ~18,000 organizations - 9 US federal agencies breached including Treasury, Commerce, DHS, State - FireEye (now Mandiant) discovered the attack after their own breach - Estimated $100B+ total cost across government and private sector - The attack demonstrated that IT management tools are APEX targets — they have broad network access, elevated privileges, and are trusted by security tools

ARM is not Orion, but it's the SAME VENDOR, the SAME customer base, and operates with the SAME elevated trust in enterprise environments. Nation-state actors who successfully targeted SolarWinds once have demonstrated interest in this vendor's products as attack vectors.

**THE ACCESS CONTROL PARADOX:**

ARM manages WHO CAN ACCESS WHAT across the entire organization. Compromising ARM doesn't just give you access — it gives you the ability to GRANT yourself access to everything, REVOKE access from defenders, and HIDE your permission changes in the audit logs that ARM itself controls. The tool designed to enforce access control becomes the tool that subverts it.

MITRE ATT&CK techniques by tactic:

credential-access

T1003 OS Credential Dumping; T1552 Unsecured Credentials; T1555 Credentials from Password Stores; T1556 Modify Authentication Process; T1558 Steal or Forge Kerberos Tickets

collection

T1005 Data from Local System; T1114 Email Collection; T1213 Data from Information Repositories

lateral-movement

T1021 Remote Services

defense-evasion

T1036 Masquerading; T1070 Indicator Removal; T1078 Valid Accounts; T1134 Access Token Manipulation; T1211 Exploitation for Stealth; T1550 Use Alternate Authentication Material

exfiltration

T1041 Exfiltration Over C2 Channel

discovery

T1046 Network Service Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1482 Domain Trust Discovery; T1615 Group Policy Discovery

execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1569 System Services

privilege-escalation

T1068 Exploitation for Privilege Escalation

persistence

T1098 Account Manipulation; T1133 External Remote Services; T1136 Create Account; T1505 Server Software Component; T1547 Boot or Logon Autostart Execution

initial-access

T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise

impact

T1485 Data Destruction; T1491 Defacement; T1531 Account Access Removal

reconnaissance

T1591 Gather Victim Org Information

defense-impairment

T1685 Disable or Modify Tools

Remediation for SolarWinds ARM deserialization RCE

Patches

• ARM 2024.3 — Fixes 13 CVEs including 6 critical unauthenticated RCE (July 17, 2024)
• ARM 2024.3.1 — Fixes CVE-2024-28991 (deserialization RCE) and CVE-2024-28990 (hardcoded creds) (September 12, 2024)
• ARM 2024.3.1 SR — Latest service release

Immediate actions

• PATCH IMMEDIATELY: Upgrade SolarWinds ARM to version 2024.3.1 SR (latest). Versions prior to 2024.3 contain 6 UNAUTHENTICATED SYSTEM-level RCE vulnerabilities. This is not a routine patch — it is an emergency remediation for pre-auth RCE.
• NETWORK ISOLATION: Until patching is confirmed, isolate ARM servers from all non-essential network access. ARM should ONLY be accessible from dedicated management workstations. Block all inbound access from user networks and the internet.
• AUDIT ARM ACTIVITY: Review ARM server logs for any signs of exploitation — unexpected process creation, file system modifications, new user accounts, or permission changes. Attackers gaining SYSTEM access via these vulnerabilities can modify Active Directory permissions silently.
• CREDENTIAL ROTATION: Rotate ALL credentials used by ARM for Active Directory integration, file server access, and database connections. Hard-coded credentials (CVE-2024-23473, CVE-2024-28990) may have been extracted and used for persistence.
• VERIFY ACTIVE DIRECTORY INTEGRITY: Compare current AD group memberships, OU delegations, and GPO assignments against known-good baselines. An attacker who compromised ARM could have granted themselves persistent admin access through AD permission modifications.

Workarounds

• If unable to patch immediately: restrict network access to ARM server to management-only VLAN with jump server access only
• Disable any ARM web interfaces exposed to non-admin networks
• Implement network-level monitoring for exploitation indicators: unusual .NET deserialization payloads, directory traversal patterns (../../), command execution from ARM process

Longer-term hardening

• MANAGEMENT TOOL SECURITY ARCHITECTURE: Treat ARM and all IT management tools as TIER ZERO infrastructure — same security tier as domain controllers. Dedicated management networks, jump servers, hardware MFA, continuous monitoring. The SUNBURST lesson: management tools with broad access are the highest-value targets.
• DEFENSE IN DEPTH FOR ACCESS CONTROL: Do not rely on a single tool (ARM) as the sole source of truth for access rights. Implement independent monitoring of AD permissions, file server ACLs, and group memberships that does NOT depend on ARM. If ARM is compromised, you need an independent detection capability.
• VENDOR RISK ASSESSMENT: SolarWinds has demonstrated a pattern of systemic vulnerabilities across multiple products (ARM, Web Help Desk, Orion, Serv-U, Platform). Evaluate whether the organizational risk of running SolarWinds products is acceptable given the vendor's security track record. Consider alternative access rights management solutions.
• DESERIALIZATION HARDENING: If continuing to use ARM, implement network-level controls that restrict which endpoints can communicate with ARM services. Use application-aware firewalls or WAFs to inspect and filter serialized data payloads.
• CONTINUOUS VULNERABILITY MONITORING: Subscribe to SolarWinds Trust Center advisories and ZDI published advisories. ARM vulnerabilities are discovered primarily through ZDI — new disclosures should trigger immediate assessment.

Affected and fixed versions

• GNU — InetUtils
  Vulnerable versions: All versions before patch
  Fixed in: Patched versions (see codeberg commits)
• Debian — inetutils-telnetd
  Vulnerable versions: All unpatched versions
  Fixed in: See debian-lts-announce

Timeline of SolarWinds ARM deserialization RCE

• 2020-03-01 SolarWinds Orion supply chain compromised by Russian SVR (APT29/Cozy Bear). Trojanized updates (SUNBURST backdoor) delivered to ~18,000 organizations including 9 US federal agencies. Estimated $100B+ impact. Establishes SolarWinds products as proven nation-state targets. Any vulnerability in SolarWinds products carries elevated strategic risk. Source: CISA Emergency Directive 21-01.
• 2023-10-01 Trend Micro Zero Day Initiative (ZDI) researchers begin systematic security assessment of SolarWinds Access Rights Manager. Piotr Bazydlo (@chudypb) and anonymous researchers identify multiple critical vulnerability classes: deserialization of untrusted data, directory traversal, exposed dangerous methods, and hardcoded credentials. Research would yield 16+ CVEs over the following year.
• 2024-05-09 SolarWinds discloses first ARM vulnerability batch: CVE-2024-28075 (CVSS 9.0, deserialization RCE) and CVE-2024-23473 (CVSS 8.6, hardcoded credentials auth bypass). Fixed in ARM 2023.2.4. The deserialization vulnerability (CVE-2024-28075) would later be found to have an incomplete fix. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28075
• 2024-07-17 SolarWinds releases ARM 2024.3 fixing 13 CVEs simultaneously — the largest single-product security patch in SolarWinds history. Includes 6 critical unauthenticated SYSTEM-level RCE vulnerabilities (CVE-2024-28074, CVE-2024-23469, CVE-2024-23470, CVE-2024-23466, CVE-2024-23467, CVE-2024-23475). CVE-2024-28074 is explicitly a BYPASS of the CVE-2024-28075 fix from May. All discovered via ZDI. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28074
• 2024-09-12 SolarWinds releases ARM 2024.3.1 fixing CVE-2024-28991 (CVSS 9.0, deserialization RCE) and CVE-2024-28990 (CVSS 6.3, hardcoded credentials). This is the THIRD deserialization RCE patch in 4 months, demonstrating the attack surface cannot be fully eliminated with point fixes. Discovered by Piotr Bazydlo (@chudypb) of ZDI. Source: https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28991
• 2024-10-15 SolarWinds discloses CVE-2024-28988 (CVSS 9.8, Web Help Desk Java deserialization RCE) — demonstrating that deserialization vulnerabilities are SYSTEMIC across SolarWinds products, not isolated to ARM. Web Help Desk would go on to have 5+ more critical CVEs through 2026 including CVE-2025-40551 (added to CISA KEV Feb 2026). The deserialization problem is architectural across the SolarWinds ecosystem.
• 2025-01-28 SolarWinds discloses 5 new Web Help Desk CVEs (4 Critical, 1 High) including CVE-2025-40551 (deserialization RCE, CVSS 9.8) and CVE-2025-40552 (auth bypass, CVSS 9.8). CVE-2025-40551 added to CISA Known Exploited Vulnerabilities catalog Feb 3, 2026. Demonstrates continuing pattern of critical vulnerabilities across SolarWinds product line.
• 2026-02-03 CISA adds SolarWinds Web Help Desk CVE-2025-40551 (deserialization RCE) to Known Exploited Vulnerabilities catalog with 3-day remediation deadline (due Feb 6, 2026). Confirms active exploitation in the wild of SolarWinds deserialization vulnerabilities. While this is WHD not ARM, it validates that SolarWinds deserialization flaws ARE being exploited by threat actors.
• 2026-02-11 Revalidation assessment: SolarWinds ARM remains a HIGH-RISK product. The deserialization attack surface has required 3+ patches and persists architecturally. The broader SolarWinds ecosystem shows the same vulnerability patterns across ARM, Web Help Desk, Serv-U, and Platform products. Combined with the SUNBURST supply chain precedent, organizations running SolarWinds ARM should treat it as Tier Zero critical infrastructure requiring maximum security controls — or evaluate alternative solutions.
• 2026-05-29 As of 2026-05-29, this threat (identifiers.cve=CVE-2026-24061, GNU InetUtils telnetd auth-bypass/argument-injection, CVSS 9.8) is still active: it is in CISA KEV (added 2026-01-26) and under ongoing in-the-wild exploitation (waves since 2026-01-22, actor 'rwxrwx'). Despite an available patch (InetUtils >2.7), ~221k telnet hosts remain exposed and GreyNoise still observes active exploitation.

Sources cited for SolarWinds ARM deserialization RCE

• SolarWinds Advisory — CVE-2024-28074 (ARM Internal Deserialization RCE, CVSS 9.6) solarwinds.com · Vendor report · 2024-07-17
• SolarWinds Advisory — CVE-2024-28075 (ARM Deserialization RCE, CVSS 9.0) solarwinds.com · Vendor report · 2024-05-09
• SolarWinds Advisory — CVE-2024-28991 (ARM Deserialization RCE, CVSS 9.0) solarwinds.com · Vendor report · 2024-09-12
• SolarWinds Advisory — CVE-2024-23469 (ARM Exposed Dangerous Method RCE, CVSS 9.6) solarwinds.com · Vendor report · 2024-07-17
• SolarWinds Advisory — CVE-2024-23470 (ARM UserScriptHumster Pre-Auth RCE, CVSS 9.6) solarwinds.com · Vendor report · 2024-07-17
• SolarWinds Advisory — CVE-2024-23466 (ARM Directory Traversal RCE, CVSS 9.6) solarwinds.com · Vendor report · 2024-07-17
• SolarWinds Advisory — CVE-2024-23475 (ARM Directory Traversal File Delete + Info Disclosure, CVSS 9.6) solarwinds.com · Vendor report · 2024-07-17
• SolarWinds Trust Center — Full Security Advisory Catalog solarwinds.com · Vendor report · 2026-02-11
• SolarWinds ARM 2024.3 Release Notes documentation.solarwinds.com · Vendor report · 2024-07-17
• SolarWinds ARM 2024.3.1 Release Notes documentation.solarwinds.com · Vendor report · 2024-09-12

More in vulnerability

• Critical Citrix XenServer Vulnerability (CVE-2026-98432, CVE-2026-102703) Could Let Attackers Take Over Virtualization Hosts Without Authentication
• Multiple Vulnerabilities in Fortigate NGFW Before V7.4.1 on Siemens RUGGEDCOM APE1808 Devices (SSA-366067)
• CVE-2025-40944: Denial-of-Service Vulnerability in Siemens SIMATIC ET 200 Devices (SSA-674753)
• OpenAI Cyber Model Uncovers 948 Linux Kernel Local Privilege Escalation Vulnerabilities
• Zyxel GS1900 Switch Zero-Day (CVE-2026-107441) Exploited by Kapibala in Red Heron Campaign, ~1,000 Switches Compromised