SolarWinds Observability Self-Hosted before 2026.4 has broken authorization
Original title: SolarWinds security advisory (AV26-1068)
Canada’s Cyber Centre points administrators to CVE-2026-28328 and says to apply SolarWinds updates when available.
On October 21, 2026, the Canadian Centre for Cyber Security issued advisory AV26-1068. As of October 20, 2026, SolarWinds Observability Self-Hosted prior to 2026.4 is affected by a broken authorization schema tracked as CVE-2026-28328. The centre urges users and administrators to review the linked SolarWinds material and apply necessary updates as they become available. No exploitation status is given.
Unconfirmed: The advisory does not state whether CVE-2026-28328 is being exploited.
- Advisory serial number is AV26-1068, dated October 21, 2026.
- The named issue is a broken authorization schema, CVE-2026-28328.
- Affected product is SolarWinds Observability Self-Hosted prior to 2026.4.
Impact: Broken authorization in SolarWinds Observability Self-Hosted
| Product | Affected | Fixed in |
|---|---|---|
| SolarWinds Observability Self-Hosted | Prior to 2026.4 | 2026.4 |
- 1.Review the SolarWinds advisory links and apply available updates.
- CVEs
- CVE-2026-28328
- Vendors
- SolarWinds
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-28328 | Broken authorization in SolarWinds Observability Self-Hosted | 8.8 | — |
From the original article
1 min read at cyber.gc.ca
Serial Number: AV26-1068 Date: October 21, 2026 As of October 20, 2026, SolarWinds is affected by vulnerabilities in the following product: SolarWinds Observability Self-Hosted Prior to 2026. 4 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.