CVE-2026-28325: SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code executio

SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted

SolarWinds patched two unauthenticated RCE flaws in Observability Self-Hosted, with no exploitation reported.

SolarWinds patched two unauthenticated remote code execution flaws in Observability Self-Hosted, affecting all versions through 2026.2.2 and fixed in 2026.2.3. CVE-2026-28324 (CVSS 9.8) is an insufficient integrity check on non-default, non-secure configurations, and CVE-2026-28325 (CVSS 8.8) is deserialization of untrusted data when a specific communication mode is used. The company also recently fixed CVE-2026-28326 (CVSS 8.8), a hardcoded static key in Access Rights Manager through version 2026.2. SolarWinds said none of these defects are known to be exploited and credited Kai Huang of Armadin for the Observability reports.

SecurityWeekSep 24, 10:40 UTC · 2d agoVulnerability CVE-2026-28324 CVE-2026-28325 CVE-2026-28326

Critical SolarWinds Flaws Let Attackers Remotely Execute Code on Observability Servers

SolarWinds patches critical CVEs allowing unauthenticated RCE on Observability Self-Hosted servers in non-default configs.

SolarWinds has released Observability Self-Hosted 2026.2.3 to patch two critical vulnerabilities that allow unauthenticated attackers to remotely execute code. CVE-2026-28324, rated 9.8, is due to insufficient integrity checks in non-default, non-secure configurations, while CVE-2026-28325 (8.8) is caused by unsafe deserialization in specific communication modes. The vulnerabilities affect deployments using Web Performance Monitor (WPM) players, and SolarWinds has ended support for older versions like 2024.2.

Cyber Security NewsSep 23, 08:15 UTC · 4d agoVulnerability CVE-2026-28324 CVE-2026-283251

SolarWinds Observability Flaws Let Unauthenticated Attackers Execute Remote Code

SolarWinds patched two unauthenticated RCE flaws in Observability Self-Hosted 2026.2.3; CVE-2026-28324 scores CVSS 9.8, CVE-2026-28325 scores 8.8, no exploitation reported.

SolarWinds released Observability Self-Hosted 2026.2.3 on September 22, 2026, fixing CVE-2026-28324 (CVSS 9.8, unauthenticated RCE via insufficient integrity checks) and CVE-2026-28325 (CVSS 8.8, unauthenticated RCE from deserializing untrusted data). Both flaws require non-default or specific communication-mode configurations to be exploitable. Kai Huang of Armadin reported the vulnerabilities through responsible disclosure, and no evidence of active exploitation was provided.

GBHackersSep 23, 11:32 UTC · 3d agoVulnerability CVE-2026-28324 CVE-2026-28325

SolarWinds security advisory (AV26-950)

Canadian Cyber Centre advisory warns of unauthenticated and authenticated RCE flaws in SolarWinds Observability Self-Hosted.

The Canadian Centre for Cyber Security has issued an advisory for SolarWinds Observability Self-Hosted, warning of two Remote Code Execution vulnerabilities. CVE-2026-28325 is an unauthenticated RCE flaw, while CVE-2026-28324 is an authenticated RCE vulnerability. Users are advised to update to version 2026.2.3 or later to mitigate these security risks.

Canadian Centre for Cyber SecuritySep 23, 14:45 UTC · 3d agoAdvisory CVE-2026-28325 CVE-2026-28324

CVE-2026-28325

In the news4 stories

SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted

Critical SolarWinds Flaws Let Attackers Remotely Execute Code on Observability Servers

SolarWinds Observability Flaws Let Unauthenticated Attackers Execute Remote Code

SolarWinds security advisory (AV26-950)