Reported by 11 outlets
SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted
Why this score
- Breadth
- 2.00 / 2.0 · 11 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 1.90 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.29 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
SolarWinds released patches for critical remote code execution flaws in Observability Self-Hosted, a self-hosted and hybrid IT monitoring platform. CVE-2026-28324 (CVSS 9.8) is an insufficient integrity check leading to unauthenticated RCE on non-default configurations; CVE-2026-28325 (CVSS 8.8) is a deserialization of untrusted data weakness affecting installations using a specific communication mode. Both impact all versions up to 2026.2.2 and were fixed in version 2026.2.3. Kai Huang from Armadin is credited for reporting both defects. SolarWinds also previously patched CVE-2026-28326 (CVSS 8.8) in Access Rights Manager, caused by a hardcoded static key affecting versions up to 2026.2; that advisory was published on September 17, 2026.
No in-the-wild exploitation has been reported for any of these three flaws. Organizations running Observability Self-Hosted or ARM should upgrade to 2026.2.3 (Observability) and ARM 2026.2.1 (ARM) without delay. The combined CVSS scores and unauthenticated attack surface make these high-priority updates, particularly for environments with non-default or externally exposed configurations.
Timeline
-
original reporting
SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted
securityweek.com · 19d ago · September 24th, 2026
SolarWinds has released patches for two severe vulnerabilities in Observability Self-Hosted that could be exploited for remote code execution (RCE). Observability Self-Hosted is an on-premises and hybrid IT monitoring solution that provides organizations with unified monitoring across environments, configuration management, and control over operational data and security compliance. The first flaw, tracked as CVE-2026-28324 (CVSS score of 9.8), is an insufficient integrity check issue leading to RCE on deployments that run non-default and non-secure configurations. Tracked as CVE-2026-28325 (CVSS score of 8.8), the second bug is described as a deserialization of untrusted data weakness affecting installations configured to use a specific communication mode. Both security defects, SolarWinds says, can be exploited by remote attackers without authentication. The vulnerabilities impact all Observability Self-Hosted versions up to 2026.2.2 and were addressed in version 2026.2.3. SolarWinds credited Kai Huang from Armadin for reporting both flaws. Last week, the company patched another unauthenticated RCE bug reported by the security researcher. Tracked as CVE-2026-28326 (CVSS score of 8.8) and affecting SolarWinds’s Access Rights Manager (ARM), it exists because ARM versions up to 2026.2 contain a hardcoded static key. SolarWinds makes no mention of any of these security defects being exploited in the wild. Additional information is avail
-
update from solarwinds.com
SolarWinds Access Rights Manager Unauthenticated Remote Code Execution Vulnerability (CVE-2026-28326)
solarwinds.com · 27d ago · September 17th, 2026
SolarWinds published the ARM advisory on September 17, 2026, five days before the Observability Self-Hosted advisories.
-
update from nvd.nist.gov
NVD entry for CVE-2026-28326
nvd.nist.gov · 26d ago · September 17th, 2026
The NVD record for CVE-2026-28326 was published 2026-09-17T17:16:39Z, confirming the ARM advisory date of September 17, 2026.
-
update from solarwinds.com
SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability (CVE-2026-28324)
solarwinds.com · 22d ago · September 22nd, 2026
It describes an unauthenticated RCE from insufficient integrity checks affecting Observability Self-Hosted 2026.2.2 and below, fixed in 2026.2.3, with CVSS 3.1 score 9.8 and a network attack vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
-
mentioned by solarwinds.com
SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability (CVE-2026-28325)
solarwinds.com · 22d ago · September 22nd, 2026
-
update from nvd.nist.gov
NVD entry for CVE-2026-28324
nvd.nist.gov · 21d ago · September 22nd, 2026
The NVD record for CVE-2026-28324 was published 2026-09-22T20:17:03Z per the NVD API 2.0. It preserves the vendor description of an unauthenticated RCE due to insufficient integrity checks in non-default, non-secure configurations and independently confirms the disclosure date of the advisory.
-
mentioned by nvd.nist.gov
NVD entry for CVE-2026-28325
nvd.nist.gov · 21d ago · September 22nd, 2026
-
update from securityonline.info
SolarWinds Observability vulnerabilities allow RCE via CVE-2026-28324. Update to version 2026.2.3 to secure your monitoring infrastructure t
securityonline.info · 21d ago · September 23rd, 2026
Update to version 2026.2.3 to secure your monitoring infrastructure t
via Mastodon https://securityonline.info/solarwinds-observability-vulnerabilities-fixed/?utm_source=mastodon&utm_medium=jetpack_social
-
update from cyberpress.org
SolarWinds Observability Flaws Let Unauthenticated Attackers Execute Remote Code
cyberpress.org · 20d ago · September 23rd, 2026
SolarWinds said both vulnerabilities affect deployments operating under specific non-default communication or configuration conditions, making configuration reviews as important as applying the available update. An unauthenticated attacker could exploit the weakness to execute code remotely against installations configured in a non-default, non-secure manner. In a deserialization attack, an application processes externally supplied serialized data and reconstructs it into objects. When validation or integrity controls are inadequate, an attacker may manipulate that input to trigger unintended application b
-
update from gbhackers.com
SolarWinds Observability Flaws Let Unauthenticated Attackers Execute Remote Code
gbhackers.com · 20d ago · September 23rd, 2026
This update was released on September 22, 2026, […] The post SolarWinds Observability Flaws Let Unauthenticated Attackers Execute Remote Code appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from malware.news
SolarWinds security advisory (AV26-950)
malware.news · 20d ago · September 23rd, 2026
Serial number: AV26-950 Date: September 23, 2026 As of September 22, 2026, SolarWinds is affected by vulnerabilities in the following product: SolarWinds Observability Self-Hosted Prior to 2026.2.3 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available.
-
update from beyondmachines.net
SolarWinds Patches Critical Remote Code Execution Flaws in Observability and ARM Platforms SolarWinds patched three vulnerabilities in its O
beyondmachines.net · 18d ago · September 25th, 2026
SolarWinds Patches Critical Remote Code Execution Flaws in Observability and ARM Platforms SolarWinds patched three vulnerabilities in its O
via Mastodon https://beyondmachines.net/event_details/solarwinds-patches-critical-remote-code-execution-flaws-in-observability-and-arm-platforms-k-7-v-u-j/gD2P6Ple2L
-
mentioned by dev.to
SolarWinds Observability Self-Hosted: Two Pre-Authentication RCE Vulnerabilities Fixed with Different Configuration Requirements # security
dev.to · 18d ago · September 25th, 2026
-
mentioned by cyber.netsecops.io
📰 SolarWinds Patches Critical Unauthenticated RCE Flaws in Observability Platform SolarWinds patches two unauthenticated RCE vulnerabilities
cyber.netsecops.io · 18d ago · September 25th, 2026
-
update from dailytechnow.com
SolarWinds Critical Vulnerability: RCE Flaw Patched # SolarWinds # Vulnerability # Cybersecurity # CVE202628324 # InfoSec A monitoring syste
dailytechnow.com · 18d ago · September 26th, 2026
SolarWinds Critical Vulnerability: RCE Flaw Patched # SolarWinds # Vulnerability # Cybersecurity # CVE202628324 # InfoSec A monitoring syste
via Mastodon https://dailytechnow.com/solarwinds-critical-vulnerability/