SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted
SolarWinds patched two unauthenticated RCE flaws in Observability Self-Hosted, with no exploitation reported.
67
Vulnerability2 · 1 read
CVE-2026-28325
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
Description · NVD
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode.
- Weakness
- CWE-502
- Vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
4 storiesCritical SolarWinds Flaws Let Attackers Remotely Execute Code on Observability Servers
SolarWinds patches critical CVEs allowing unauthenticated RCE on Observability Self-Hosted servers in non-default configs.
65
SolarWinds Observability Flaws Let Unauthenticated Attackers Execute Remote Code
SolarWinds patched two unauthenticated RCE flaws in Observability Self-Hosted 2026.2.3; CVE-2026-28324 scores CVSS 9.8, CVE-2026-28325 scores 8.8, no exploitation reported.
62
SolarWinds security advisory (AV26-950)
Canadian Cyber Centre advisory warns of unauthenticated and authenticated RCE flaws in SolarWinds Observability Self-Hosted.
45