SolarWinds Observability Self-Hosted Patches Critical Unauthenticated RCE
Patch & Detection Intelligence · 13 sources · Updated 1mo ago · First seen Sep 22, 2026
SolarWinds released SolarWinds Observability Self-Hosted 2026.2.3 to remediate two unauthenticated remote-code-execution flaws: CVE-2026-28324 (CVSS 9.8) and CVE-2026-28325 (CVSS 8.8). CVE-2026-28324 affects deployments using a non-default, non-secure configuration and stems from insufficient integrity checks (CWE-345); it can be exploited remotely without authentication or user interaction, with potential total compromise of confidentiality, integrity, and availability. CVE-2026-28325 arises from deserialization of untrusted data in a specific communication mode.
CISA SSVC data for CVE-2026-28324 identifies exploitation as automatable and the technical impact as total, although no known active exploitation was reported. Organizations running affected self-hosted SolarWinds environments should prioritize upgrading to version 2026.2.3, especially where non-default insecure configurations or the affected communication mode are in use. The update also changes Web Performance Monitor player upgrade behavior by migrating default passive players to active mode and generating strong passwords for remotely installed passive players, alongside platform and application-monitoring defect fixes.
