Advisory · CVE-2026-28325
Deserialization RCE in SolarWinds Observability Self-Hosted
SolarWinds Observability Self-Hosted is affected by an unauthenticated remote code execution flaw from deserialization of untrusted data in a specific communication mode. CVSS 8.8.
- Vendor
- SolarWinds
- Product
- Observability Self-Hosted
- Identifier / CWE
- CVE-2026-28325
CWE-502 - Action timing
- Immediate
Explain it like I’m five
A parcel room opens every package to sort it, without checking what is inside first. An attacker mails a jack-in-the-box, and opening it springs the trap.
- 01Adjacent access
An attacker with adjacent-network access reaches the application in the affected communication mode, no credentials needed.
- 02Serialized payload
They send crafted serialized data to the vulnerable endpoint.
- 03Unsafe deserialization
The application deserializes the untrusted data without adequate validation.
- 04Code execution
The deserialization flaw yields unauthenticated remote code execution.
What happened
SolarWinds disclosed CVE-2026-28325: SolarWinds Observability Self-Hosted versions before 2026.2.3 are affected by an unauthenticated remote code execution vulnerability from deserialization of untrusted data (CWE-502) when the application is configured to use a specific communication mode. The attack vector is adjacent network. NVD rates it CVSS 8.8 (v3.1). Fixed in 2026.2.3 per the vendor advisory.
What to do
- Upgrade SolarWinds Observability Self-Hosted to 2026.2.3 or later.
- Verify the application is not running in the affected communication mode unless required, and segment it from untrusted adjacent networks.
- Review logs for anomalous serialized payloads and rotate platform-accessible credentials if needed.
Management note
Deserialization RCE pairs with the integrity-check RCE in the same release: the monitoring tier needs the 2026.2.3 upgrade as a single job, plus a review of how much of the network can reach it.