SolarWinds Observability Flaws Let Unauthenticated Attackers Execute Remote Code
SolarWinds patched two unauthenticated RCE flaws in Observability Self-Hosted 2026.2.3; CVE-2026-28324 scores CVSS 9.8, CVE-2026-28325 scores 8.8, no exploitation reported.
SolarWinds released Observability Self-Hosted 2026.2.3 on September 22, 2026, fixing CVE-2026-28324 (CVSS 9.8, unauthenticated RCE via insufficient integrity checks) and CVE-2026-28325 (CVSS 8.8, unauthenticated RCE from deserializing untrusted data). Both flaws require non-default or specific communication-mode configurations to be exploitable. Kai Huang of Armadin reported the vulnerabilities through responsible disclosure, and no evidence of active exploitation was provided.
- CVE-2026-28324 (CVSS 9.8): unauthenticated RCE via insufficient integrity checks
- CVE-2026-28325 (CVSS 8.8): unauthenticated RCE from deserializing untrusted data
- Both require non-default, non-secure configurations; no active exploitation reported
- Upgrade via Settings > My Deployment; segment and de-expose SolarWinds services meanwhile
- Organizations
- SolarWindsArmadinKai Huang
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-28324 | SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks | 9.8 | — | ||
| CVE-2026-28325 | SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of… | 8.8 | — |
From the original article
2 min read at gbhackers.com
SolarWinds has released SolarWinds Observability Self-Hosted version 2026. 2. 3 to address two critical remote code execution (RCE) vulnerabilities.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.