SolarWinds Patches Two RCE Flaws in Observability Self-Hosted
First coverage.
SolarWinds patched two unauthenticated Observability Self-Hosted RCE bugs; sources disagree on whether 2026.2.3 is affected.
SolarWinds patched two unauthenticated remote code execution flaws in Observability Self-Hosted, CVE-2026-28324 (CVSS 9.8) and CVE-2026-28325 (CVSS 8.8). SecurityWeek describes CVE-2026-28324 as an insufficient integrity check on non-default, non-secure configurations and CVE-2026-28325 as deserialization of untrusted data in a specific communication mode. SecurityWeek says both affect versions through 2026.2.2 and are fixed in 2026.2.3, while WIRED says they affect all versions up to 2026.2.3. SolarWinds told SecurityWeek none of these defects are known to be exploited and credited Kai Huang of Armadin for the Observability reports. SecurityWeek also reports a separate recent fix for CVE-2026-28326 (CVSS 8.8), a hardcoded static key in Access Rights Manager through version 2026.2, likewise not known to be exploited. WIRED’s headline refers to an OpenAI agent and Australia’s health service, but its body only covers the SolarWinds patches.
- CVE-2026-28324 (CVSS 9.8) is an unauthenticated RCE from an insufficient integrity check on non-default, non-secure Observability Self-Hosted configurations.
- CVE-2026-28325 (CVSS 8.8) is an unauthenticated RCE from deserialization of untrusted data when a specific communication mode is used.
- SecurityWeek: both Observability flaws affect all versions through 2026.2.2 and are fixed in 2026.2.3.
- WIRED: the same two flaws affect all versions up to 2026.2.3, disagreeing with SecurityWeek on whether 2026.2.3 is the fix or still affected.
- SolarWinds says the Observability flaws are not known to be exploited and credited Kai Huang of Armadin.
- SecurityWeek also notes CVE-2026-28326 (CVSS 8.8), a hardcoded static key in Access Rights Manager through version 2026.2, which SolarWinds says is not known to be exploited.
- Vendors
- JetBrainsSolarWinds
- Malware
- TeamCity
- Organizations
- JetBrainsSolarWindsArmadin
- Countries
- U.S.
- AI models
- SolarWindsObservability Self-Hosted
Coverage
oldest first · one row per article · UTC- · Sep 24, 2026
SecurityWeekFirst report
SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted
SolarWinds patched two unauthenticated RCE flaws in Observability Self-Hosted, with no exploitation reported.
- · Sep 24, 2026
WIRED · Security
An OpenAI Agent Hacked Australia's Health Service. Their Government Found Out Months Later.
SolarWinds has patched two RCE vulnerabilities in Observability Self-Hosted, affecting all versions up to 2026.2.3.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-28324 | SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks | 9.8 | — | ||
| CVE-2026-28325 | SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of… | 8.8 | — | ||
| CVE-2026-28326 | Unauthenticated RCE in SolarWinds Access Rights Manager via hardcoded static key | 8.8 | <1% | PoC |