SolarWinds has rolled out updates to address two significant vulnerabilities found in its Observability Self-Hosted software, which could potentially be used for remote code execution (RCE) attacks.
Understanding the Vulnerabilities
Observability Self-Hosted is designed to offer organizations comprehensive IT monitoring, configuration management, and security compliance. The first vulnerability, known as CVE-2026-28324 with a CVSS score of 9.8, arises from inadequate integrity checks. This flaw poses a risk in environments that do not use default or secure settings, potentially allowing unauthorized remote code execution.
The second issue, CVE-2026-28325, carries a CVSS score of 8.8 and involves the deserialization of untrusted data. This vulnerability affects systems configured to employ a specific communication mode, making them susceptible to attacks from remote, unauthenticated users.
Impact and Resolution
These security issues affect all versions of Observability Self-Hosted up to 2026.2.2, with fixes implemented in version 2026.2.3. SolarWinds acknowledges Kai Huang from Armadin for identifying and reporting these vulnerabilities.
Last week, an additional unauthenticated RCE vulnerability, CVE-2026-28326, was patched. This flaw impacted SolarWinds’s Access Rights Manager (ARM) due to a hardcoded static key present in versions up to 2026.2.
Security Implications and Future Outlook
SolarWinds has not reported any active exploitation of these vulnerabilities. Users are encouraged to review the detailed information available on the company’s security advisories page for guidance on protecting their systems.
With cybersecurity threats constantly evolving, it is crucial for organizations to stay informed about potential vulnerabilities and take proactive measures to secure their IT environments.
