# SolarWinds Access Rights Manager (ARM) Systemic Deserialization RCE — 17 CVEs, 6 Unauth SYSTEM RCE, Access Control Paradox

> SolarWinds Access Rights Manager (ARM) contains a systemic pattern of critical deserialization, directory traversal, and remote code execution vulnerabilities — 16+ CVEs disclosed between May 2024 and September 2024, with 8 rated CVSS 9.0+ (Critical) including 6 enabling unauthenticated SYSTEM-level remote code execution. The vulnerabilities were primarily discovered by Piotr Bazydlo (@chudypb) and anonymous researchers through Trend Micro's Zero Day Initiative (ZDI), revealing fundamental architectural flaws in ARM's .NET deserialization handling, file system operations, and authentication mechanisms. ARM is used by enterprises to manage Active Directory permissions, file server access rights, and compliance auditing — making it a high-value target where compromise grants attackers direct control over organizational access control infrastructure. The vulnerability cluster spans three major patch cycles (ARM 2024.3, 2024.3.1, and 2024.3.1 SR) with one CVE (CVE-2024-28074) being a bypass of a previous incomplete fix. This product sits within the SolarWinds ecosystem, which was the vector for the catastrophic SUNBURST supply chain attack (2020) by Russian SVR (APT29/Cozy Bear), making any SolarWinds product vulnerability carry elevated strategic risk due to the proven nation-state interest in this vendor's software.

- **Published:** 2026-02-02T19:40:00Z
- **Last reviewed:** 2026-02-02T19:40:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0016
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-solarwinds-arm-deserialization-rce-tl-2026-0016.webp?v=75a0fa0d (Threadlinqs threat intel: SolarWinds ARM 2024.3 Deserialization RCE: Detection & IOCs (TL-2026-0016) — Critical severity, 65 IOCs, 9 detection rules.)
- **ID:** TL-2026-0016
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 65
- **CVEs:** CVE-2026-24061, CVE-2024-23465, CVE-2024-23466, CVE-2024-23467, CVE-2024-23468, CVE-2024-23469, CVE-2024-23470, CVE-2024-23471, CVE-2024-23472, CVE-2024-23473, CVE-2024-23474, CVE-2024-23475, CVE-2024-28074, CVE-2024-28075, CVE-2024-28990, CVE-2024-28991, CVE-2024-28992

## Description

SolarWinds Access Rights Manager (ARM) is an enterprise tool for managing, auditing, and provisioning access rights across Active Directory, Exchange, SharePoint, file servers, and other Windows infrastructure. Organizations use ARM to answer critical compliance questions: 'Who has access to what?' and 'Who changed what permissions?' ARM sits at the CENTER of the access control infrastructure — it has read and write access to Active Directory permissions, file server ACLs, and group memberships across the entire organization.

**THE VULNERABILITY LANDSCAPE — 16+ CVEs IN 5 MONTHS:**

Between May and September 2024, SolarWinds disclosed 16+ vulnerabilities in ARM across three patch cycles, representing one of the densest vulnerability clusters for a single enterprise product:

**July 17, 2024 — ARM 2024.3 (Mega-Patch: 13 CVEs):**

1. **CVE-2024-28074** (CVSS 9.6, Critical) — Internal Deserialization RCE. BYPASS of a previous incomplete fix. An anonymous ZDI researcher found that controls implemented for an earlier deserialization vulnerability could be circumvented using a different exploitation method. This is the CORE vulnerability for TL-2026-0016: .NET deserialization of untrusted data enabling unauthenticated remote code execution.

2. **CVE-2024-23469** (CVSS 9.6, Critical) — Exposed Dangerous Method RCE. Allows unauthenticated user to perform actions with SYSTEM privileges. Discovered by Piotr Bazydlo (@chudypb) of ZDI.

3. **CVE-2024-23470** (CVSS 9.6, Critical) — UserScriptHumster Exposed Dangerous Method. Pre-authentication remote command execution — unauthenticated user can run arbitrary commands and executables.

4. **CVE-2024-23471** (CVSS 9.6, Critical) — CreateFile Directory Traversal RCE. Authenticated user can abuse SolarWinds service for remote code execution.

5. **CVE-2024-23466** (CVSS 9.6, Critical) — Directory Traversal RCE. Unauthenticated user can perform remote code execution.

6. **CVE-2024-23475** (CVSS 9.6, Critical) — Directory Traversal and Information Disclosure. Unauthenticated arbitrary file deletion and sensitive information leakage.

7. **CVE-2024-23472** (CVSS 9.6, Critical) — Directory Traversal Arbitrary File Deletion and Information Disclosure.

8. **CVE-2024-23467** (CVSS 9.6, Critical) — Directory Traversal and Information Disclosure enabling RCE.

9. **CVE-2024-23465** (CVSS 8.3, High) — ChangeHumster Exposed Dangerous Method Authentication Bypass.

10. **CVE-2024-28992** (CVSS 7.6, High) — Traversal and Information Disclosure.

11. **CVE-2024-28993** (CVSS 7.6, High) — Traversal and Information Disclosure.

12. **CVE-2024-23468** (CVSS 7.6, High) — Traversal and Information Disclosure.

13. **CVE-2024-23474** (CVSS 7.6, High) — deleteTransferFile Directory Traversal, Arbitrary File Deletion and Information Disclosure.

**May 9, 2024 — ARM 2023.2.4 Patch:**

14. **CVE-2024-28075** (CVSS 9.0, Critical) — Deserialization of Untrusted Data RCE. The ORIGINAL deserialization vulnerability that CVE-2024-28074 later bypassed.

15. **CVE-2024-23473** (CVSS 8.6, High) — Hard-Coded Credentials Authentication Bypass.

**September 12, 2024 — ARM 2024.3.1:**

16. **CVE-2024-28991** (CVSS 9.0, Critical) — Deserialization of Untrusted Data RCE. ANOTHER deserialization RCE after the two previous patches. Authenticated user can abuse the service for remote code execution. Discovered by Piotr Bazydlo (@chudypb) of ZDI.

17. **CVE-2024-28990** (CVSS 6.3, Medium) — Hardcoded Credentials Authentication Bypass.

**THE PATTERN — SYSTEMIC ARCHITECTURAL FAILURE:**

The ARM vulnerability cluster reveals SYSTEMIC problems, not isolated bugs:

1. **Deserialization is fundamentally broken**: Three separate deserialization RCE CVEs (CVE-2024-28075, CVE-2024-28074, CVE-2024-28991) across three patch cycles. The second was explicitly a bypass of the first fix. The vendor cannot eliminate the deserialization attack surface — it keeps resurfacing.

2. **Directory traversal is pervasive**: 7+ CVEs for directory traversal alone, spanning file creation, file deletion, information disclosure, and remote code execution. The application's file system operations lack consistent input validation.

3. **Authentication is weak**: Hard-coded credentials (CVE-2024-23473, CVE-2024-28990) and authentication bypass (CVE-2024-23465) across multiple versions. Credentials baked into the application that persist across versions.

4. **Dangerous methods are exposed**: Multiple 'Exposed Dangerous Method' CVEs (CVE-2024-23469, CVE-2024-23470) allowing unauthenticated SYSTEM-level execution. The application exposes internal functionality to network-accessible interfaces without authorization checks.

5. **Incomplete fixes recur**: CVE-2024-28074 explicitly states it bypasses controls implemented for a previous vulnerability. This suggests patch-and-pray development rather than root cause analysis.

**SOLARWINDS SUPPLY CHAIN CONTEXT — SUNBURST:**

Any SolarWinds product vulnerability carries elevated strategic risk because of the 2020 SUNBURST supply chain attack:

- Russian SVR (APT29/Cozy Bear) compromised SolarWinds Orion build process
- Trojanized updates delivered to ~18,000 organizations
- 9 US federal agencies breached including Treasury, Commerce, DHS, State
- FireEye (now Mandiant) discovered the attack after their own breach
- Estimated $100B+ total cost across government and private sector
- The attack demonstrated that IT management tools are APEX targets — they have broad network access, elevated privileges, and are trusted by security tools

ARM is not Orion, but it's the SAME VENDOR, the SAME customer base, and operates with the SAME elevated trust in enterprise environments. Nation-state actors who successfully targeted SolarWinds once have demonstrated interest in this vendor's products as attack vectors.

**THE ACCESS CONTROL PARADOX:**

ARM manages WHO CAN ACCESS WHAT across the entire organization. Compromising ARM doesn't just give you access — it gives you the ability to GRANT yourself access to everything, REVOKE access from defenders, and HIDE your permission changes in the audit logs that ARM itself controls. The tool designed to enforce access control becomes the tool that subverts it.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1098 Account Manipulation
- T1136 Create Account
- T1078 Valid Accounts
- T1068 Exploitation for Privilege Escalation
- T1070 Indicator Removal
- T1211 Exploitation for Stealth
- T1552 Unsecured Credentials
- T1003 OS Credential Dumping
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1021 Remote Services
- T1550 Use Alternate Authentication Material
- T1005 Data from Local System
- T1531 Account Access Removal
- T1485 Data Destruction
- T1195 Supply Chain Compromise
- T1133 External Remote Services
- T1569 System Services
- T1505 Server Software Component
- T1547 Boot or Logon Autostart Execution
- T1134 Access Token Manipulation
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1556 Modify Authentication Process
- T1555 Credentials from Password Stores
- T1558 Steal or Forge Kerberos Tickets
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1482 Domain Trust Discovery
- T1615 Group Policy Discovery
- T1213 Data from Information Repositories
- T1114 Email Collection
- T1041 Exfiltration Over C2 Channel
- T1491 Defacement

## Free detection (Splunk SPL)

**SolarWinds ARM Service Spawning Unexpected Child Process — Deserialization RCE Exploitation** (`TL-2026-0016-SPL-001`)

Detects unexpected child process creation by the SolarWinds Access Rights Manager service processes (SolarWindsARM.exe, ARMService.exe, SolarWinds.ARM.WebAPI.exe). Successful exploitation of deserialization vulnerabilities (CVE-2024-28074, CVE-2024-28075, CVE-2024-28991) or exposed dangerous methods (CVE-2024-23469, CVE-2024-23470) yields SYSTEM-level code execution, which manifests as the ARM service spawning cmd.exe, powershell.exe, or other executables. ARM processes should ONLY spawn known ARM child processes — any other child process is a strong exploitation indicator requiring immediate incident response.

- **Language:** Splunk SPL
- **ATT&CK:** T1190, T1059.001, T1059.003, T1068
- **Data sources:** sysmon, windows_security, edr_telemetry
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| search ParentImage IN ("*\\SolarWindsARM.exe", "*\\ARMService.exe", "*\\SolarWinds.ARM.WebAPI.exe", "*\\SolarWinds.ARM.BusinessLayer.exe", "*\\w3wp.exe")
| eval is_arm_child=if(match(Image, "(?i)(SolarWinds|ARM|dotnet|conhost)"), "expected", "unexpected")
| where is_arm_child="unexpected"
| eval severity=case(
    match(Image, "(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|certutil\.exe|bitsadmin\.exe)"), "CRITICAL — command interpreter from ARM service (active exploitation)",
    match(Image, "(?i)(net\.exe|net1\.exe|dsadd\.exe|dsmod\.exe|dsget\.exe|csvde\.exe|ldifde\.exe)"), "CRITICAL — AD management tool from ARM (persistence attempt)",
    match(Image, "(?i)(whoami\.exe|ipconfig\.exe|systeminfo\.exe|nltest\.exe|tasklist\.exe)"), "HIGH — reconnaissance from ARM service",
    match(Image, "(?i)(procdump|mimikatz|rubeus|sharphound)"), "CRITICAL — offensive tool from ARM service",
    1=1, "HIGH — unknown process from ARM service")
| table _time host ParentImage Image CommandLine User severity
| sort -severity -_time
```

**Known false positives:**

- ARM legitimate update processes — whitelist specific ARM updater executables and verify digital signatures. ARM diagnostic utilities — document and whitelist approved diagnostic tools. IIS worker process (w3wp.exe) spawning legitimate ARM components — baseline normal w3wp child processes for the ARM application pool.

**Tuning notes:** Sysmon Event ID 1 (ProcessCreate) provides the most reliable parent-child process telemetry. For w3wp.exe parent filtering, restrict to the specific IIS application pool running ARM (AppPool name in CommandLine). The CRITICAL severity for cmd.exe/powershell.exe from ARM is high-confidence — ARM services should NEVER spawn interactive shells. Consider automated response: kill the child process and isolate the ARM server from the network when this fires.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- .NET Deserialization Payload in ARM Network Traffic — BinaryFormatter Exploitation (locked: unlock with TL Creds)
- DCSync Replication Request from SolarWinds ARM Server — Credential Theft Post-Exploitation (locked: unlock with TL Creds)
- SolarWinds ARM Audit Log Tampering or Gap — Evidence Destruction Post-Exploitation (locked: unlock with TL Creds)
- SolarWinds ARM Exposed Method Access — UserScriptHumster/ChangeHumster Pre-Auth Exploitation (locked: unlock with TL Creds)
- LSASS Memory Access from SolarWinds ARM Server Process — Credential Dumping Post-Exploitation (locked: unlock with TL Creds)
- Lateral Movement from SolarWinds ARM Server — SMB Admin Share and WinRM Post-Exploitation (locked: unlock with TL Creds)
- Active Directory Privileged Group Modification from ARM Server — Post-Exploitation Persistence (locked: unlock with TL Creds)
- Directory Traversal Pattern in ARM Web Service Requests — Path Traversal Exploitation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [SolarWinds Advisory — CVE-2024-28074 (ARM Internal Deserialization RCE, CVSS 9.6)](https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28074)
- [SolarWinds Advisory — CVE-2024-28075 (ARM Deserialization RCE, CVSS 9.0)](https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28075)
- [SolarWinds Advisory — CVE-2024-28991 (ARM Deserialization RCE, CVSS 9.0)](https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28991)
- [SolarWinds Advisory — CVE-2024-23469 (ARM Exposed Dangerous Method RCE, CVSS 9.6)](https://www.solarwinds.com/trust-center/security-advisories/cve-2024-23469)
- [SolarWinds Advisory — CVE-2024-23470 (ARM UserScriptHumster Pre-Auth RCE, CVSS 9.6)](https://www.solarwinds.com/trust-center/security-advisories/cve-2024-23470)
- [SolarWinds Advisory — CVE-2024-23466 (ARM Directory Traversal RCE, CVSS 9.6)](https://www.solarwinds.com/trust-center/security-advisories/cve-2024-23466)
- [SolarWinds Advisory — CVE-2024-23475 (ARM Directory Traversal File Delete + Info Disclosure, CVSS 9.6)](https://www.solarwinds.com/trust-center/security-advisories/cve-2024-23475)
- [SolarWinds Trust Center — Full Security Advisory Catalog](https://www.solarwinds.com/trust-center/security-advisories)
- [SolarWinds ARM 2024.3 Release Notes](https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htm)
- [SolarWinds ARM 2024.3.1 Release Notes](https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3-1_release_notes.htm)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0016