SolarWinds fixes critical RCE bugs in access rights audit solution

SolarWinds released patches for five remote code execution vulnerabilities in Access Rights Manager—three rated critical (including CVE-2023-40057, CVE-2024-23476, CVE-2024-23479) and two high—rooted in path traversal and deserialization flaws that permit unauthenticated code execution on unpatched systems; fixes are included in ARM 2023.2.3, most issues were reported through Trend Micro’s ZDI, and SolarWinds reports no known active exploitation. The report also recalls the March 2020 SolarWinds supply-chain compromise (APT29) to highlight potential supply-chain risk context.