CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

SolarWinds Observability Self-Hosted: unauthenticated RCE via insufficient integrity checks (CVSS 9.8), no confirmed exploitation

cve · CVE-2026-28324

Coverage
1
first 2026-09-24 → last 2026-09-30
Latest activity
2026-09-24
SolarWinds patches two unauthenticated RCE flaws in its self-hosted monitoring platform
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector
Sources cited
5
5 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-28324, newest first. Check the date before acting on an older one.

  • Upgrade every SolarWinds Observability Self-Hosted deployment to 2026.2.3, and remove any internet exposure of SolarWinds management and communication services while the vendor withholds which configuration and communication mode are vulnerable.
    2026-09-24CVE-2026-28324 +1

Defender insights

What each entry about CVE-2026-28324 tells a defender to do, newest first.

2026-09-24NOTABLESolarWinds patches two unauthenticated RCE flaws in its self-hosted monitoring platform

Detection

Story timeline

  1. 2026-09-24CVE-2026-28324 / CVE-2026-28325: SolarWinds Observability Self-Hosted, two unauthenticated remote-code-execution flaws, no confirmed exploitation yet (CVSS 9.8 / 8.8)
    trending-vulnerabilitiesSolarWinds patches two unauthenticated RCE flaws in its self-hosted monitoring platform

Hunting pivots

Affected products
SolarWinds Observability Self-Hosted
Tags
auth-bypasspatch-availablercevulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-24/solarwinds-observability-cve-2026-28324-28325-unauth-rce · ATT&CK page ↗

Entries about SolarWinds Observability Self-Hosted: unauthenticated RCE via insufficient integrity checks (CVSS 9.8), no confirmed exploitation (1)

2026-09-24 · view entry permalink →

NOTABLECVE-2026-28324 +1updatedNATOA2

CVE-2026-28324 / CVE-2026-28325: SolarWinds Observability Self-Hosted, two unauthenticated remote-code-execution flaws, no confirmed exploitation yet (CVSS 9.8 / 8.8)

SolarWinds released Observability Self-Hosted 2026.2.3 on 2026-09-22, fixing two unauthenticated remote-code-execution vulnerabilities that researcher Kai Huang of Armadin reported through responsible disclosure (SolarWinds, 2026-09-22). CVE-2026-28324 (CVSS 9.8) stems from insufficient integrity checks and affects installations running in a configuration SolarWinds describes only as "non-default and non-secure," without naming the specific setting; its trust-center advisory lists Observability Self-Hosted 2026.2.2 and below as affected (SolarWinds Trust Center, 2026-09-22). CVE-2026-28325 (CVSS 8.8) is a deserialization-of-untrusted-data flaw that requires the application to be configured to use "a specific communication mode," again unnamed by the vendor (SolarWinds, 2026-09-22). The same release separately reconfigures Web Performance Monitor player communications, switching default main-polling-engine players from server-initiated to player-initiated mode and issuing newly generated passwords to remote passive players, a change significant enough that SolarWinds lists it under its "Critical update advisories" heading; SolarWinds does not state that this reconfiguration is connected to either CVE (SolarWinds, 2026-09-22).

Both NCSC-NL and CERT-FR flagged the advisory the day after release, and neither adds technical detail beyond what SolarWinds published (NCSC-NL, 2026-09-23; CERT-FR, 2026-09-23). "SolarWinds has not provided technical exploit details, affected endpoint information, or evidence of active exploitation in the release notes" (GBHackers, 2026-09-23), and no vendor, national CERT or researcher source reports in-the-wild exploitation or a public proof-of-concept as of this writing. Unauthenticated code execution against internet-reachable network-monitoring infrastructure is nonetheless a high-value initial-access target regardless of confirmed exploitation status today.

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected.

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode.

SolarWinds

SolarWinds has not provided technical exploit details, affected endpoint information, or evidence of active exploitation in the release notes.

GBHackers 2026-09-23
Correctionrun 2026-09-30T0639Z-auditprioritysourcing_noteactionsbodytitlesources

SolarWinds does not state that the release's Web Performance Monitor player reconfiguration is connected to either CVE (SolarWinds, 2026-09-22), so it is no indication of which communication mode CVE-2026-28325 needs. SolarWinds' trust-center advisory for CVE-2026-28324 confirms the 9.8 Critical rating and lists Observability Self-Hosted 2026.2.2 and below as affected (SolarWinds Trust Center, 2026-09-22).

vulnerability24 Sep 04:35Zmulti-sourceOpen finding →
Sources: SolarWinds (official Observability Self-Hosted 2026.2.3 release notes) · NCSC-NL (Dutch national CERT) · CERT-FR / ANSSI (French national CERT) · GBHackers · SolarWinds Trust Center (CVE-2026-28324 advisory)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • advisories.ncsc.nl1 (20%)
  • cert.ssi.gouv.fr1 (20%)
  • documentation.solarwinds.com1 (20%)
  • gbhackers.com1 (20%)
  • solarwinds.com1 (20%)

External references

NVD · cve.org · CISA KEV

All cited sources (5)