SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted
SolarWinds patched two unauthenticated RCE flaws in Observability Self-Hosted, with no exploitation reported.
SolarWinds patched two unauthenticated remote code execution flaws in Observability Self-Hosted, affecting all versions through 2026.2.2 and fixed in 2026.2.3. CVE-2026-28324 (CVSS 9.8) is an insufficient integrity check on non-default, non-secure configurations, and CVE-2026-28325 (CVSS 8.8) is deserialization of untrusted data when a specific communication mode is used. The company also recently fixed CVE-2026-28326 (CVSS 8.8), a hardcoded static key in Access Rights Manager through version 2026.2. SolarWinds said none of these defects are known to be exploited and credited Kai Huang of Armadin for the Observability reports.
- CVE-2026-28324 scores 9.8 and can yield unauthenticated RCE on non-secure configs.
- CVE-2026-28325 scores 8.8 and is unsafe deserialization in a specific communication mode.
- Both affect Observability Self-Hosted through 2026.2.2 and are fixed in 2026.2.3.
- SolarWinds reports no in-the-wild exploitation of these flaws or of ARM bug CVE-2026-28326.
- Vendors
- SolarWinds
- Organizations
- Armadin
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-28324 | SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks | 9.8 | — | ||
| CVE-2026-28325 | SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of… | 8.8 | — | ||
| CVE-2026-28326 | Unauthenticated RCE in SolarWinds Access Rights Manager via hardcoded static key | 8.8 | <1% | PoC |
From the original article
2 min read at securityweek.com
The vulnerabilities, tracked as CVE-2026-28324 and CVE-2026-28325, can be exploited without authentication. The post SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.