Act nowDisclosed

Advisory · CVE-2026-28324

Unauthenticated RCE in SolarWinds Observability Self-Hosted via integrity check gap

SolarWinds Observability Self-Hosted contains an unauthenticated remote code execution flaw from insufficient integrity checks, affecting non-default, non-secure configurations. CVSS 9.8.

Advisory published September 22, 2026Independent summary
Vendor
SolarWinds
Product
Observability Self-Hosted
Identifier / CWE
CVE-2026-28324
CWE-345
Action timing
Immediate
ELI5

Explain it like I’m five

A security camera hub accepts software updates without checking the signature on the box. Anyone who can reach the hub can hand it a box labeled update that is actually a burglar.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Reachable instance

    An attacker reaches a SolarWinds Observability Self-Hosted instance in a non-default, non-secure configuration, with no credentials.

  2. 02Integrity gap

    The application performs insufficient integrity checks on the relevant data.

  3. 03Payload delivered

    The attacker supplies crafted data that the platform accepts as legitimate.

  4. 04Code execution

    The flaw yields unauthenticated remote code execution on the monitoring platform.

What happened

SolarWinds disclosed CVE-2026-28324: SolarWinds Observability Self-Hosted versions before 2026.2.3 are affected by an unauthenticated remote code execution vulnerability caused by insufficient integrity checks (CWE-345). Installations configured in a non-default and non-secure configuration are affected. NVD rates it CVSS 9.8 (v3.1). The vendor advisory and 2026.2.3 release notes carry the fix.

What to do

  1. Upgrade SolarWinds Observability Self-Hosted to 2026.2.3 or later immediately.
  2. Review the SolarWinds secure configuration guidance linked in the advisory and move instances to the default secure configuration.
  3. Investigate platform logs for unexpected activity, since the monitoring server typically holds broad credentials.
  4. Rotate credentials stored in or accessible from the platform if compromise cannot be ruled out.

Management note

Unauthenticated RCE on the monitoring platform is the nightmare scenario: the system that watches everything becomes the attacker’s vantage point. Given SolarWinds history, treat any internet-facing instance as potentially compromised until logs say otherwise.