Enterprise identity auditing software maintainers have released security maintenance updates to address a high severity remote code execution vulnerability in access governance tools. Unauthenticated remote actors can exploit deserialization errors to execute commands under SYSTEM privileges.
The security update fixes deserialization vulnerability CVE-2026-107220 affecting SolarWinds Access Rights Manager ARM software installations. The defect resides within background RPC processing daemons handling administrative configuration requests. Unauthenticated remote adversaries transmit malformed serialized objects over port 55555 to trigger untrusted object deserialization, executing arbitrary operating system commands with SYSTEM privileges on the host server. Official security bulletins urge enterprise IT administrators to apply current fixed release builds.
Subverting access rights management servers exposes Active Directory authorization structures and enterprise identity records. Because ARM tools manage user provisioning, group policy audits, and Active Directory permissions, a host-level compromise permits threat actors to extract directory credentials and manipulate access control lists.
– Upgrade SolarWinds Access Rights Manager ARM installations immediately to official fixed release build 2026.4 or higher.
– Restrict inbound network connectivity to ARM RPC management ports using internal host firewalls and network segmentation rules.
– Inspect ARM server process trees for unauthorized shell invocations originating from the SolarWinds service daemon process.
– Audit Active Directory administrative group memberships and access rights changes processed during recent management windows.
Identity auditing platform defense demands rigid input deserialization sanitization and strict RPC interface isolation to ensure access governance servers remain protected from unauthenticated remote command execution. #CodeDefence #SolarWinds #ARM #ActiveDirectory #IdentitySecurity #RCE #Deserialization #AppSec #PatchManagement
/
