What’s Vulnerable › Vulnerabilities

CVE-2023-35186: SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-19 · updated 2026-06-17
• Weakness: CWE-502

Description

The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution.

Affected products

• SolarWinds Access Rights Manager: through 2023.2.0.73

References

• https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1_release_notes.htm
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35186
• https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2023-2-1_release_notes.htm
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-35186

Get alerted when CVE-2023-35186 or the next vulnerability affects your stack