--- schema: 1 kind: vulnerability title: "CVE-2026-28324 / CVE-2026-28325 — SolarWinds Observability Self-Hosted: two unauthenticated remote-code-execution flaws, no confirmed exploitation yet (CVSS 9.8 / 8.8)" headline: "SolarWinds patches two unauthenticated RCE flaws in its self-hosted monitoring platform" summary: > SolarWinds released Observability Self-Hosted 2026.2.3 on 2026-09-22, fixing two unauthenticated remote-code-execution vulnerabilities reported by researcher Kai Huang of Armadin: CVE-2026-28324 (CVSS 9.8), an integrity-check bypass affecting non-default, non-secure configurations, and CVE-2026-28325 (CVSS 8.8), a deserialization-of-untrusted-data flaw reachable when the application uses a specific communication mode. Neither SolarWinds nor NCSC-NL or CERT-FR, both of which flagged the advisory the next day, report active exploitation or public proof-of-concept as of this writing. discovered_at: "2026-09-24T04:35:00Z" updated_at: null event_date: "2026-09-22" run_id: 2026-09-24T0405Z-intel priority: high immediate_action: null tags: [vulnerabilities, rce, auth-bypass, patch-available] regions: [global] sectors: [public-sector] entities: ["product:solarwinds-observability-self-hosted"] techniques: [T1190] affected_products: ["SolarWinds Observability Self-Hosted"] cves: - id: CVE-2026-28324 cvss: "9.8" epss: null type: rce vector: zero-click auth: pre-auth status: [patch-available] affected: "every release before 2026.2.3, when running in a non-default, non-secure configuration" fixed: "2026.2.3" - id: CVE-2026-28325 cvss: "8.8" epss: null type: deserialization vector: zero-click auth: pre-auth status: [patch-available] affected: "every release before 2026.2.3, when configured to use a specific communication mode" fixed: "2026.2.3" sources: - url: "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-2-3_release_notes.htm" publisher: "SolarWinds (official Observability Self-Hosted 2026.2.3 release notes)" date: "2026-09-22" role: primary - url: "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0388" publisher: "NCSC-NL (Dutch national CERT)" date: "2026-09-23" role: corroborating - url: "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1215/" publisher: "CERT-FR / ANSSI (French national CERT)" date: "2026-09-23" role: corroborating - url: "https://gbhackers.com/solarwinds-observability-flaws/" publisher: "GBHackers" date: "2026-09-23" role: corroborating closed_sources: [] evidence: - quote: "SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected." publisher: "SolarWinds" - quote: "SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode." publisher: "SolarWinds" - quote: "SolarWinds has not provided technical exploit details, affected endpoint information, or evidence of active exploitation in the release notes." publisher: "GBHackers" verification: multi-source sourcing_note: "SolarWinds' own vendor advisory is the sole source for both CVEs' technical description and CVSS scores (Admiralty A); NCSC-NL and CERT-FR both restate the same vendor advisory rather than independently assessing the flaws, so this is one assessor with several publishers for corroboration purposes (credibility 2, not 1) — the trust-center advisory pages themselves return 403 on every fetch transport tried on 2026-09-24, so the citation is to SolarWinds' own release-notes documentation instead." confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Upgrade every SolarWinds Observability Self-Hosted deployment to 2026.2.3 via Settings > My Deployment now; before or during the upgrade, audit which Web Performance Monitor players and other SolarWinds services are internet-reachable, and confirm no deployment is running the communication-mode or integrity-check configuration the advisory calls non-default and non-secure." updates: [] migrated_from: null --- SolarWinds released Observability Self-Hosted 2026.2.3 on 2026-09-22, fixing two unauthenticated remote-code-execution vulnerabilities that researcher Kai Huang of Armadin reported through responsible disclosure ([SolarWinds, 2026-09-22](https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-2-3_release_notes.htm)). CVE-2026-28324 (CVSS 9.8) stems from insufficient integrity checks and affects installations running in a configuration SolarWinds describes only as "non-default and non-secure," without naming the specific setting ([SolarWinds, 2026-09-22](https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-2-3_release_notes.htm)). CVE-2026-28325 (CVSS 8.8) is a deserialization-of-untrusted-data flaw that requires the application to be configured to use "a specific communication mode," again unnamed by the vendor ([SolarWinds, 2026-09-22](https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-2-3_release_notes.htm)). The same release separately reconfigures Web Performance Monitor player communications — switching default main-polling-engine players from server-initiated to player-initiated mode and issuing newly generated passwords to remote passive players — a change significant enough that SolarWinds frames it as a "critical update advisory" in its own right; SolarWinds does not state that this reconfiguration is connected to either CVE ([SolarWinds, 2026-09-22](https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-2-3_release_notes.htm)). Both NCSC-NL and CERT-FR flagged the advisory the day after release, and neither adds technical detail beyond what SolarWinds published ([NCSC-NL, 2026-09-23](https://advisories.ncsc.nl/advisory?id=NCSC-2026-0388); [CERT-FR, 2026-09-23](https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1215/)). "SolarWinds has not provided technical exploit details, affected endpoint information, or evidence of active exploitation in the release notes" ([GBHackers, 2026-09-23](https://gbhackers.com/solarwinds-observability-flaws/)) — no vendor, national CERT or researcher source reports in-the-wild exploitation or a public proof-of-concept as of this writing. Unauthenticated code execution against internet-reachable network-monitoring infrastructure is nonetheless a high-value initial-access target regardless of confirmed exploitation status today. **Detection:** SolarWinds has not published attack signatures for either flaw. Given CVE-2026-28325's likely tie to a specific communication mode, prioritise identifying which Web Performance Monitor players (main-polling-engine default, remote passive, remote active) are internet-reachable, and monitor SolarWinds Platform service logs for unexpected inbound connections to WPM-player communication ports from unrecognised hosts, followed by unexpected process spawns under the SolarWinds Platform service account. **Defender takeaway:** upgrade every Observability Self-Hosted deployment to 2026.2.3 now; audit for any deployment running the "non-default and non-secure" configuration the advisory references, remove unnecessary internet exposure of SolarWinds management and communication services, and account for the same-release WPM player reconfiguration and password rotation in change management before assuming the upgrade is complete.