SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted
SolarWinds has released version 2026.2.3 of Observability Self-Hosted, its on-premises and hybrid IT monitoring platform, to fix two critical vulnerabilities that let remote attackers execute arbitrary code without ever authenticating. The flaws, tracked as CVE-2026-28324 (CVSS 9.8) and CVE-2026-28325 (CVSS 8.8), were disclosed on September 22, 2026, and both were responsibly reported by researcher Kai Huang of Armadin. SolarWinds says it has seen no evidence of exploitation in the wild for either bug.
The disclosure lands one week after SolarWinds patched a separate, unrelated unauthenticated RCE bug — CVE-2026-28326 (CVSS 8.8), a hard-coded static key in Access Rights Manager — covered in a prior Labs report. The two disclosures affect different SolarWinds products and share no common root cause; organizations running both ARM and Observability Self-Hosted need to track and patch each separately.
Vulnerability Details
| Attribute | Value |
|---|---|
| Vendor | SolarWinds |
| Product | Observability Self-Hosted (on-premises/hybrid IT monitoring) |
| CVE-2026-28324 | Insufficient integrity check (CWE-345) — CVSS 9.8 Critical |
| CVE-2026-28325 | Deserialization of untrusted data — CVSS 8.8 High |
| Authentication required | None for either flaw |
| User interaction required | None |
| Affected versions | All versions through 2026.2.2 |
| Fixed version | 2026.2.3 |
| Reported by | Kai Huang, Armadin |
| Known exploitation | None observed as of publication |
| Related but distinct issue | CVE-2026-28326 (Access Rights Manager, patched separately) |
How the Flaws Work
CVE-2026-28324 — Insufficient Integrity Checks (CVSS 9.8)
This flaw affects deployments running non-default, non-secure configurations. Because the affected communication path skips proper integrity validation, an unauthenticated attacker can send malformed network requests that bypass data validation checks entirely. CISA's SSVC scoring for this CVE flags the exploitation as automatable with a total technical impact — meaning successful exploitation can fully compromise confidentiality, integrity, and availability of the host. This is the more severe of the two flaws precisely because it requires no special access and no user action, only that a deployment has strayed from SolarWinds' secure-by-default settings.
CVE-2026-28325 — Insecure Deserialization in Web Performance Monitoring (CVSS 8.8)
The second flaw sits in the Web Performance Monitoring (WPM) component and is triggered when administrators enable specific, less-secure communication modes between WPM "players" (the agents that execute synthetic transaction checks) and the Observability server. In that configuration, the server deserializes objects it receives without adequately sanitizing them first — a classic insecure-deserialization pattern. An attacker who can reach the listening service can submit a crafted serialized payload that forces the server to execute attacker-controlled code. SolarWinds' fix reconfigures affected deployments to move passive WPM players to secure active communication modes, closing off the insecure path by default going forward.
Why Both Matter Together
Neither bug requires credentials, and both can be triggered purely over the network, which is what pushes CVE-2026-28324 to the top of the CVSS scale. Observability platforms are also attractive targets by design: they typically hold broad, standing visibility into — and often privileged access paths toward — the infrastructure they monitor, so a compromised Observability Self-Hosted server can become a pivot point into the rest of an environment rather than an isolated incident.
Impact Assessment
| Impact Area | Description |
|---|---|
| Confidentiality | Total compromise possible — attacker-controlled code execution on the monitoring server |
| Integrity | Attacker can modify monitored data, configurations, or use the server as a foothold |
| Availability | Exploitation can crash or fully take over the affected service |
| Blast radius | Observability servers often have broad network reach and privileged access to monitored infrastructure, raising pivot risk |
| Exposure window | Any internet-facing or improperly segmented instance running a non-default/non-secure configuration or legacy WPM communication mode |
| Detection difficulty | No authentication event is generated by either exploit path, complicating log-based detection |
Recommendations
For SolarWinds Administrators
- Upgrade Observability Self-Hosted to version 2026.2.3 as a high-priority, out-of-cycle patching event — do not wait for the next routine maintenance window given the unauthenticated, CVSS 9.8 nature of CVE-2026-28324.
- Audit all instances for non-default or non-secure configuration settings; where legacy settings were adopted for compatibility reasons, confirm they are still necessary after upgrading.
- Review Web Performance Monitoring deployments and confirm passive players have moved to secure active communication modes as the update intends; do not manually revert to legacy modes post-patch.
For Security Teams
- Treat any internet-facing or loosely segmented Observability Self-Hosted instance as a priority asset until patched; apply network segmentation and restrict inbound access to management and agent-communication ports to known, trusted sources only.
- Review logs and network traffic for unusual inbound connections to Observability server ports predating the patch, even though SolarWinds reports no known active exploitation — CISA's automatable exploitation rating for CVE-2026-28324 means opportunistic scanning could follow quickly once technical details circulate.
- Track this disclosure separately from CVE-2026-28326 (Access Rights Manager). Different product, different root cause, different fixed version — conflating the two in patch-tracking systems risks leaving one unpatched.
For IT Operations
- Inventory every SolarWinds Observability Self-Hosted deployment across on-premises and hybrid environments; self-hosted monitoring tools are frequently under-tracked compared to cloud-managed services.
- Validate the upgrade in a staging environment first, since the fix changes default communication behavior for WPM players, then roll out to production promptly given the severity.
- Confirm monitoring and alerting continue to function correctly after the communication-mode change, particularly for any passive WPM players that get moved to active mode.
Key Takeaways
- SolarWinds Observability Self-Hosted versions through 2026.2.2 contain two critical, unauthenticated remote code execution flaws, fixed in 2026.2.3.
- CVE-2026-28324 (CVSS 9.8) stems from insufficient integrity checks in non-default, non-secure configurations and is rated automatable with total technical impact by CISA's SSVC.
- CVE-2026-28325 (CVSS 8.8) is an insecure deserialization flaw in the Web Performance Monitoring component, triggered by specific legacy communication modes.
- Neither flaw requires authentication or user interaction, and SolarWinds reports no evidence of active exploitation as of this disclosure.
- This is a separate, unrelated vulnerability pair from CVE-2026-28326, the hard-coded key flaw SolarWinds patched in Access Rights Manager the prior week — patch both independently.
- Given the CVSS 9.8 severity and unauthenticated network vector, organizations should treat the upgrade to 2026.2.3 as an urgent, out-of-band patching priority.