SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted
SolarWinds patched two unauthenticated RCE flaws in Observability Self-Hosted, with no exploitation reported.
67
Vulnerability3 · 1 read
CVE-2026-28324
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
Description · NVD
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected.
- Weakness
- CWE-345
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
4 storiesCritical SolarWinds Flaws Let Attackers Remotely Execute Code on Observability Servers
SolarWinds patches critical CVEs allowing unauthenticated RCE on Observability Self-Hosted servers in non-default configs.
65
SolarWinds Observability Flaws Let Unauthenticated Attackers Execute Remote Code
SolarWinds patched two unauthenticated RCE flaws in Observability Self-Hosted 2026.2.3; CVE-2026-28324 scores CVSS 9.8, CVE-2026-28325 scores 8.8, no exploitation reported.
62
SolarWinds security advisory (AV26-950)
Canadian Cyber Centre advisory warns of unauthenticated and authenticated RCE flaws in SolarWinds Observability Self-Hosted.
45