Loading story…
SolarWinds released SolarWinds Observability Self-Hosted 2026.2.3 to remediate two unauthenticated remote-code-execution flaws: CVE-2026-28324 (CVSS 9.8) and CVE-2026-28325 (CVSS 8.8). CVE-2026-28324 affects deployments using a non-default, non-secure configuration and stems from insufficient integrity checks (CWE-345); it can be exploited remotely without authentication or user interaction, with potential total compromise of confidentiality, integrity, and availability. CVE-2026-28325 arises from deserialization of untrusted data in a specific communication mode.
CISA SSVC data for CVE-2026-28324 identifies exploitation as automatable and the technical impact as total, although no known active exploitation was reported. Organizations running affected self-hosted SolarWinds environments should prioritize upgrading to version 2026.2.3, especially where non-default insecure configurations or the affected communication mode are in use. The update also changes Web Performance Monitor player upgrade behavior by migrating default passive players to active mode and generating strong passwords for remotely installed passive players, alongside platform and application-monitoring defect fixes.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
SolarWinds received CVE-2026-28325 for an unauthenticated RCE vulnerability caused by deserialization of untrusted data in a specific communication mode. CISA's SSVC assessment recorded no known exploitation, no automation, and total technical impact.
CVE-2026-28324 was added to the CVE record. The critical 9.8 vulnerability permits unauthenticated remote code execution in SolarWinds Observability Self-Hosted deployments using a non-default, non-secure configuration due to insufficient integrity checks.
SolarWinds released version 2026.2.3, fixing unauthenticated RCE flaws CVE-2026-28324 (CVSS 9.8) and CVE-2026-28325 (CVSS 8.8). Kai Huang of Armadin responsibly reported both vulnerabilities; CVE-2026-28325 involves deserialization of untrusted data in a specific communication mode.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcedocumentation.solarwinds.com
Open sourcesolarwinds.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds released a security update for **Web Help Desk 2026.1 and all previous versions** to remediate **`CVE-2026-28299`**, a network-exploitable denial-of-service vulnerability. According to the vendor notice cited by EG-FinCIRT, the flaw has **low attack complexity** and can be triggered **without privileges or user interaction**, increasing the risk of opportunistic exploitation against exposed systems. Successful exploitation could exhaust memory, crash the Web Help Desk server, and disrupt service availability. Organizations using SolarWinds Web Help Desk were urged to validate and deploy the update as soon as testing is complete to reduce the risk of outages caused by unauthenticated attacks.
Jul 8, 2026
**CVE-2025-26399** is a **critical insecure deserialization** flaw (CWE-502) in *SolarWinds Web Help Desk* that enables **unauthenticated remote code execution/command execution** over the network. The issue resides in the product’s **`AjaxProxy`** component, where untrusted serialized data can be processed without sufficient validation, allowing an attacker to deliver a crafted payload that results in arbitrary command execution on the host running the help desk application. Multiple reports indicate the vulnerability is **actively exploited in the wild**, prompting **CISA** to add CVE-2025-26399 to the **Known Exploited Vulnerabilities (KEV)** catalog. NetSPI notes the flaw was disclosed in 2025 and is described as a **patch bypass** related to earlier issues (**CVE-2024-28988** and **CVE-2024-28986**), and recommends immediate remediation by upgrading to **SolarWinds Web Help Desk 12.8.7 Hotfix 1 or later**; if patching is delayed, organizations should restrict network exposure of the server and increase monitoring for suspicious process execution and outbound connections.
Jun 29, 2026
SolarWinds released security updates for **Web Help Desk (WHD)** to address two critical vulnerabilities affecting versions **12.4 through 12.8**. One issue, **`CVE-2024-28986`**, is a Java deserialization flaw that can lead to **remote code execution** and carries a **CVSS 9.8** rating; public reporting said the vulnerability was **actively exploited**. A second critical issue, tracked in SolarWinds advisories as **`CVE-2024-28987`**, involves **built-in accounts with default passwords** that could let attackers gain unauthorized remote access and modify data. SolarWinds advised customers to **upgrade to WHD 12.8.3** and apply **Hotfix 1** and **Hotfix 2**, with backups taken before installing the fixes. The vendor published a trust-center advisory for `CVE-2024-28987`, while external incident reporting highlighted the urgency of patching because the flaws could allow both full compromise of vulnerable servers and abuse of default credentials in exposed deployments.
Jul 24, 2026