{"id":"CVE-2024-28074","title":"It was discovered that a previous vulnerability was not completely fixed with SolarWinds Access Rights Manager","summary":"It was discovered that a previous vulnerability was not completely fixed with SolarWinds Access Rights Manager. While some controls were implemented the researcher was able to bypass these and use a different method to exploit the vulner…","severity":"critical","cvss":9.6,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-502"],"vendor":"solarwinds","product":"access_rights_manager","affected":["access_rights_manager <= 2023.2.4"],"published":"2024-07-17","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:17:17.127","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-28074","references":[{"url":"https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htm","label":"psirt@solarwinds.com"},{"url":"https://documentation.solarwinds.com/en/success_center/arm/content/release_notes/arm_2024-3_release_notes.htm","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2024-07-19T03:55:34.586635Z"},"epss":0.10917,"epssPercentile":0.95904,"ingestedAt":"2026-11-05T06:38:03.575Z","slug":"CVE-2024-28074","body":"## Overview\n\nIt was discovered that a previous vulnerability was not completely fixed with SolarWinds Access Rights Manager. While some controls were implemented the researcher was able to bypass these and use a different method to exploit the vulnerability.\n\n## Affected\n\n- `access_rights_manager <= 2023.2.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":52.8,"likelihood":2.2,"exploitation":0,"ransomware":0},"changes":[]}