CVE-2026-28324 / CVE-2026-28325: SolarWinds Observability Self-Hosted, two unauthenticated remote-code-execution flaws, no confirmed exploitation yet (CVSS 9.8 / 8.8)
SolarWinds patches two unauthenticated RCE flaws in its self-hosted monitoring platform
Defender actions
- Upgrade every SolarWinds Observability Self-Hosted deployment to 2026.2.3, and remove any internet exposure of SolarWinds management and communication services (CVE-2026-28324 is network-reachable) while SolarWinds' advisories and release notes name neither the vulnerable configuration nor the communication mode.
Analysis
SolarWinds released Observability Self-Hosted 2026.2.3 on 2026-09-22, fixing two unauthenticated remote-code-execution vulnerabilities that researcher Kai Huang of Armadin reported through responsible disclosure (SolarWinds, 2026-09-22). CVE-2026-28324 (CVSS 9.8) stems from insufficient integrity checks and affects installations running in a configuration SolarWinds describes only as "non-default and non-secure," without naming the specific setting; its trust-center advisory lists Observability Self-Hosted 2026.2.2 and below as affected (SolarWinds Trust Center, 2026-09-22). CVE-2026-28325 (CVSS 8.8, scored with an adjacent-network attack vector (SolarWinds Trust Center, 2026-09-22)) is a deserialization-of-untrusted-data flaw that requires the application to be configured to use "a specific communication mode," again unnamed by the vendor (SolarWinds, 2026-09-22). The same release separately reconfigures Web Performance Monitor player communications, switching default main-polling-engine players from server-initiated to player-initiated mode and issuing newly generated passwords to remote passive players, a change significant enough that SolarWinds lists it under its "Critical update advisories" heading; the release notes do not tie this reconfiguration to either CVE (SolarWinds, 2026-09-22). Neither trust-center advisory gives a workaround (SolarWinds Trust Center, 2026-09-22; SolarWinds Trust Center, 2026-09-22).
Both NCSC-NL and CERT-FR flagged the advisory the day after release, and neither adds technical detail beyond what SolarWinds published (NCSC-NL, 2026-09-23; CERT-FR, 2026-09-23). "SolarWinds has not provided technical exploit details, affected endpoint information, or evidence of active exploitation in the release notes" (GBHackers, 2026-09-23), and no vendor, national CERT or researcher source reports in-the-wild exploitation or a public proof-of-concept as of this writing. CVE-2026-28324, scored with a network attack vector, is the flaw that exposes an internet-reachable deployment in the affected configuration to unauthenticated code execution; CVE-2026-28325 needs an attacker on an adjacent network.
Cited evidence
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected.
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode.
SolarWinds has not provided technical exploit details, affected endpoint information, or evidence of active exploitation in the release notes.
Updates3
SolarWinds' release notes do not tie the release's Web Performance Monitor player reconfiguration to either CVE (SolarWinds, 2026-09-22), so it is no indication of which communication mode CVE-2026-28325 needs. SolarWinds' trust-center advisory for CVE-2026-28324 confirms the 9.8 Critical rating and lists Observability Self-Hosted 2026.2.2 and below as affected (SolarWinds Trust Center, 2026-09-22).
SolarWinds' own vectors separate the two flaws: CVE-2026-28324 is scored AV:N, reachable over the network (SolarWinds Trust Center, 2026-09-22), while CVE-2026-28325 is scored AV:A/AC:L/PR:N/UI:N, which requires an attacker on an adjacent network (SolarWinds Trust Center, 2026-09-22). Removing internet exposure narrows who can reach the first, though any network position can still reach it; the second needs the upgrade even on an internal-only deployment.
The statement that SolarWinds connects the WPM player changes to neither CVE went beyond the source: what SolarWinds publishes is that its release notes do not tie the reconfiguration to either CVE (SolarWinds, 2026-09-22). Neither trust-center advisory gives a workaround or names the vulnerable configuration or communication mode (SolarWinds Trust Center, 2026-09-22; SolarWinds Trust Center, 2026-09-22), and CVE-2026-28325 is scored with an adjacent-network attack vector, so only CVE-2026-28324 is reachable from the internet.
Sources6
Revision history
- Published 2026-09-24T0405Z-intel
- Correction 2026-09-30T0639Z-audit
The Detection line and the action tied CVE-2026-28325 to the Web Performance Monitor player reconfiguration, a link SolarWinds does not make and the analysis itself calls unstated. The speculative link is removed, the sourcing note now cites SolarWinds' trust-center advisory for CVE-2026-28324 without rating narration, and the priority moves from high to notable: no exploitation of either flaw is reported, CVE-2026-28324 needs a non-default, non-secure configuration and CVE-2026-28325 a communication mode SolarWinds does not name, so exposure cannot be established.
Changed: priority sourcing_note actions body title sources
- Correction 2026-10-11T1307Z-audit
SolarWinds scores CVE-2026-28325 with an adjacent-network attack vector, not a network one, so it is not scored as reachable from the internet; CVE-2026-28324 is the network-vector flaw. Both vectors are now recorded, the CVE-2026-28325 trust-center advisory is cited, and the action's internet-exposure step is tied to CVE-2026-28324.
Changed: cves sources actions body
- Correction 2026-10-20T0835Z-audit
SolarWinds' release notes do not tie the WPM player reconfiguration to either CVE, which is narrower than SolarWinds saying it connects to neither. Neither trust-center advisory gives a workaround, and CVE-2026-28325 is scored with an adjacent-network vector, so only CVE-2026-28324 is reachable from the internet.
Changed: actions body sourcing_note
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.