CVE-2023-35186 HIGH

CVE-2023-35186: SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability

Vendor Solarwinds
Product Access Rights Manager
Weakness CWE-502 · Unsafe deserialization
Published October 19, 2023
Last update September 12, 2024
View on NVD All CVEs

CVSS base score

8.0/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an authenticated user to abuse SolarWinds service resulting in remote code execution.

Key dates

02Disclosure timeline

October 19, 2023 CVE published
September 12, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-31422 WordPress Visual Art | Gallery WordPress Theme <= 2.4 - PHP Object Injection Vulnerability CVE-2023-50943 Apache Airflow: Potential pickle deserialization vulnerability in XComs CVE-2025-31052 WordPress The Fashion - Model Agency One Page Beauty Theme plugin <= 1.4.4 - Deserialization of untrusted data Vulnerability CVE-2026-11860 Insecure Deserialisation via Plaintext HTTP leading to Remote Code Execution in Quick.CMS CVE-2026-42778 Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)