Critical Zero-Day in SolarWinds Access Rights Manager (CVE-2024-28995) Under Global Active Exploitation

Executive Summary\n\nEncrygma Intelligence has identified a surge in targeted attacks leveraging CVE-2024-28995, a critical directory traversal vulnerability affecting SolarWinds Access Rights Manager (ARM). Although a patch was recently released, telemetry data suggests that several advanced persistent threat (APT) groups began exploiting the vulnerability as a zero-day prior to public disclosure. This vulnerability allows an unauthenticated remote attacker to access and read sensitive files on the host server, including configuration files containing administrative credentials and encryption keys. The exploit is currently being utilized to facilitate lateral movement within government and financial sectors globally.\n\n## Threat Analysis\n\nThe exploitation of CVE-2024-28995 represents a significant risk due to the central role SolarWinds ARM plays in managing user permissions and identities across enterprise environments. By gaining access to the ARM server's filesystem, attackers can bypass traditional authentication mechanisms. We have observed a specific focus on organizations within the North Atlantic region, with a secondary cluster of activity targeting telecommunications providers in Southeast Asia. The threat actors appear to be conducting reconnaissance on internal network topologies by exfiltrating Active Directory synchronization logs and ARM configuration databases. This suggests a long-term espionage objective rather than immediate disruptive action.\n\n## Technical Details\n\nCVE-2024-28995 is categorized as an unauthenticated directory traversal vulnerability. Specifically, the flaw resides in the web-based management interface of the SolarWinds ARM application. Due to insufficient input validation of user-supplied paths in certain API endpoints, an attacker can craft specialized HTTP requests to escape the intended directory structure. Technical analysis reveals that by utilizing encoded traversal sequences (e.g., ..%2f..%2f), attackers can reference files outside the web root. Our labs have confirmed that this can be used to read the web.config file, which often contains sensitive connection strings, and the SolarWinds.ARM.Service.exe.config file, which stores critical service-level parameters and encrypted secrets. The exploit is reliable and requires no user interaction, making it a high-value tool for initial access and internal credential harvesting.\n\n## Attribution Assessment\n\nWith high confidence, we attribute the initial wave of zero-day exploitation to a suspected Chinese-aligned threat actor, currently tracked as APT-X26 (closely resembling 'Vanguard Panda' tactics). The specific choice of targets and the precision of the file-retrieval scripts used in the campaign align with previous state-sponsored espionage operations. Furthermore, the timing of the exploitation—occurring precisely 72 hours before the patch release—indicates either advanced vulnerability research capabilities or a potential leak of vulnerability data. Secondary exploitation by broader cybercriminal elements has also been observed following the public disclosure and release of a Proof of Concept (PoC) on various underground forums.\n\n## Implications\n\nThe impact of a successful compromise via CVE-2024-28995 is severe. Because SolarWinds ARM is integrated with Active Directory and other identity providers, the exposure of its service account credentials can lead to full domain compromise. In environments where ARM manages multi-factor authentication (MFA) bypass rules, attackers can effectively neutralize identity-based security perimeters. Furthermore, the ability to read arbitrary files allows for the theft of SSL certificates and private keys, enabling subsequent Man-in-the-Middle (MitM) attacks on internal traffic.\n\n## Recommendations\n\n1. Immediate Patching: All organizations running SolarWinds ARM must upgrade to version 2024.3 or later immediately. This version contains the fix for the directory traversal flaw.\n2. Credential Rotation: Following the patch, organizations should rotate all service account passwords associated with SolarWinds ARM, as these may have been compromised during the zero-day window.\n3. Audit Log Review: Inspect web server logs for HTTP GET requests containing traversal patterns or unusual access to configuration files. Pay close attention to requests originating from non-standard IP ranges.\n4. Restrict Network Access: Limit access to the SolarWinds ARM management interface to trusted internal IP addresses or VPN segments to reduce the attack surface for unauthenticated remote actors.