A monitoring system engineered to oversee corporate infrastructure can inadvertently pave the way for an attacker to breach the network. SolarWinds has rectified a critical vulnerability within Observability Self-Hosted that permitted unauthenticated remote code execution.
Tracked as CVE-2026-28324, this flaw achieved a staggering CVSS severity score of 9.8 out of 10. Exploitation requires neither system privileges nor user interaction, and the attack complexity is deemed low. Rooted in insufficient data integrity validation, this vulnerability ultimately enables a malefactor to seize complete control of the server via remote code execution.
However, a significant caveat exists. CVE-2026-28324 exclusively impacts Observability Self-Hosted deployments utilizing a non-standard configuration that SolarWinds categorizes as insecure. The enterprise has deliberately withheld detailed attack schematics to preclude facilitating the exploitation of vulnerable systems. Threat actors target versions 2026.2.2 and earlier, while the remediation is incorporated within the 2026.2.3 release.
Within this identical update, developers eradicated another analogous issue, tracked as CVE-2026-28325, which carries a severity score of 8.8. This secondary flaw stems from the deserialization of untrusted data. While this attack similarly bypasses authentication requirements, it remains viable only when a specific communication mode between platform components is active.
Kai Huang of Armadin discovered both vulnerabilities. SolarWinds has not reported any instances of these flaws being weaponized in real-world attacks. System administrators are strongly advised to deploy Observability Self-Hosted 2026.2.3 immediately and rigorously audit their platform configurations, particularly if component communication settings deviate from default parameters.
In the officially published security advisory, SolarWinds classifies CVE-2026-28324 as a critical threat. According to the CVSS vector, an assailant can operate across the network devoid of any privileges, and successful exploitation possesses the capacity to completely obliterate the confidentiality, integrity, and availability of the system. The 2026.2.3 update was officially launched on September 22, 2026.
For SolarWinds, unauthenticated vulnerabilities have historically served as viable ingress points into corporate networks. Earlier in 2026, malicious actors targeted the Web Help Desk, subsequently escalating their penetration to exfiltrate domain credentials and establish persistence with SYSTEM-level privileges.
In June, another pernicious issue afflicted the Serv-U file server. This attack similarly required neither a password nor an active account, and CISA subsequently corroborated the exploitation of this vulnerability in live environments, adding it to their Known Exploited Vulnerabilities catalog.
The legacy of SolarWinds remains exceptionally sensitive due to the monumental compromise of Orion in 2020. Documents declassified in 2026 revealed that perpetrators of that campaign managed to surveil the email communications of the United States Department of the Treasury for months. Consequently, any novel flaws manifesting within the company’s product suite invariably attract heightened scrutiny from corporate network defenders.
