SolarWinds Patches 8 Critical Flaws in Access Rights Manager Software

SolarWinds disclosed and patched 13 vulnerabilities in its Access Rights Manager (ARM), eight of which are rated Critical (CVSS 9.6) and include remote code execution and directory traversal flaws (multiple CVEs). Successful exploitation could permit file disclosure or deletion and execution of arbitrary code with elevated privileges; fixes were released in ARM 2024.3 on July 17, 2024, following responsible disclosure via Trend Micro ZDI. The report also references related CISA action on a separate Serv-U path traversal KEV entry and recalls SolarWinds' 2020 supply-chain compromise for context.