Loading vulnerability…
Unauthenticated RCE in SolarWinds Observability Self-Hosted
CVE-2026-28325 is an untrusted-data deserialization vulnerability in SolarWinds Observability Self-Hosted versions 2026.2.2 and earlier. When an affected installation uses a specific communication mode, crafted serialized input can cause arbitrary code execution without authentication. Exploitation requires adjacent-network access. The precise communication mode and vulnerable function are not identified. Version 2026.2.3 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated attacker with adjacent-network access can execute arbitrary code on an affected SolarWinds Observability Self-Hosted installation, compromising its confidentiality, integrity, and availability. The execution privilege level and effects on systems beyond the affected installation are not established.
If you can’t patch tonight, do this now.
No separate temporary workaround is specified by the vendor. Until patching is complete, restrict access to management and application interfaces to trusted networks and authorized administrators. Review deployed communication modes and WPM player configurations, and monitor application and Windows logs for unexpected process execution. These measures reduce exposure but do not replace the update.
Patch, then assume compromise.
Upgrade SolarWinds Observability Self-Hosted to version 2026.2.3 or a later vendor-supported release containing the fix. Upgrade the full deployment, including related scalability engines and Web Performance Monitor (WPM) players. Manually update players excluded from automatic upgrades and verify component versions, communication modes, and remote passive-player credentials afterward. The update switches default-installed passive WPM players on the main polling engine to active communication and assigns strong randomly generated passwords to remote passive players.
No public exploits tracked yet. Mallory keeps watching.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.