Critical SolarWinds Flaws Let Attackers Remotely Execute Code on Observability Servers
SolarWinds patches critical CVEs allowing unauthenticated RCE on Observability Self-Hosted servers in non-default configs.
SolarWinds has released Observability Self-Hosted 2026.2.3 to patch two critical vulnerabilities that allow unauthenticated attackers to remotely execute code. CVE-2026-28324, rated 9.8, is due to insufficient integrity checks in non-default, non-secure configurations, while CVE-2026-28325 (8.8) is caused by unsafe deserialization in specific communication modes. The vulnerabilities affect deployments using Web Performance Monitor (WPM) players, and SolarWinds has ended support for older versions like 2024.2.
- SolarWinds patches two critical flaws (CVE-2026-28324, CVE-2026-28325) allowing unauthenticated remote code execution.
- CVE-2026-28324 has a CVSS score of 9.8 and stems from insufficient integrity checks in non-default configurations.
- CVE-2026-28325 (CVSS 8.8) involves unsafe deserialization of untrusted data in specific communication modes.
- Patches are in Observability Self-Hosted 2026.2.3; older versions like 2024.2 are no longer supported.
- Vendors
- SolarWinds
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-28324 | SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks | 9.8 | — | ||
| CVE-2026-28325 | SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of… | 8.8 | — |
From the original article
2 min read at cybersecuritynews.com
SolarWinds released Observability Self-Hosted 2026. 2. 3 to fix two serious vulnerabilities that could let unauthenticated attackers remotely execute code on affected observability servers.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.