Loading vulnerability…
Unauthenticated RCE in SolarWinds Observability Self-Hosted
CVE-2026-28324 is an insufficient data-authenticity verification vulnerability in SolarWinds Observability Self-Hosted versions before 2026.2.3. In installations using a non-default, non-secure configuration, insufficient integrity checks allow an unauthenticated remote attacker to submit malformed network requests and execute arbitrary code. Default secure configurations are not affected. The vulnerability has a CVSS v3.1 score of 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution with the privileges of the SolarWinds process, potentially compromising the affected application and underlying host. Confidentiality, integrity, and availability can be severely affected through unauthorized data access, data or configuration modification, and service disruption.
If you can’t patch tonight, do this now.
Until patching is complete, review and remove non-default, non-secure configurations and restrict access to affected application and management interfaces to trusted networks and administrators. Use network segmentation to limit exposure and monitor for anomalous network traffic, unexpected process execution, and unusual outbound connections. These measures do not replace the security update.
Patch, then assume compromise.
Upgrade SolarWinds Observability Self-Hosted to version 2026.2.3 or a later supported release containing the fix. Upgrade the complete deployment, including related scalability engines and Web Performance Monitor players. Manually update players excluded from automatic upgrades, and verify their versions, communication settings, and applicable credentials after upgrading.
No public exploits tracked yet. Mallory keeps watching.
42 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.