SolarWinds has issued a crucial update for its Observability Self-Hosted software, version 2026.2.3, addressing two severe security vulnerabilities. These flaws, identified as CVE-2026-28324 and CVE-2026-28325, allow unauthenticated attackers to execute code remotely on compromised servers. The vulnerabilities are present in specific non-default configurations and communication modes.
Update Released Following Critical Discovery
The update, made available on September 22, 2026, is essential for organizations utilizing SolarWinds Observability Self-Hosted, particularly those operating in environments with Web Performance Monitor (WPM) players. Exploiting these vulnerabilities could enable attackers to execute arbitrary commands without authentication, putting system security at significant risk.
CVE-2026-28324 is notably serious, receiving a 9.8 out of 10 on the CVSS severity scale. This underscores the necessity for immediate attention by IT security teams to patch affected systems.
Understanding the Risks Involved
The vulnerabilities arise from inadequate integrity checks in non-default, unsecured configurations of the Observability Self-Hosted installations. Although the advisory does not include a public proof-of-concept, the high severity of these issues highlights the need for prioritizing patches for exposed servers.
The second vulnerability, CVE-2026-28325, also poses a significant threat with a CVSS score of 8.8. It involves the unsafe deserialization of untrusted data, which occurs when software processes serialized data controlled by an attacker without adequate validation.
Security Enhancements and Recommendations
Both vulnerabilities were responsibly reported by Kai Huang of Armadin, and SolarWinds has addressed these issues in the 2026.2.3 release. While the update does not introduce new features, it includes vital security fixes and improvements in platform reliability.
The update modifies the behavior of WPM player deployments. Passive players installed by default on the main polling engine will transition to player-initiated communication. Remote passive players will receive strong, randomly generated passwords during the upgrade.
Administrators are advised to upgrade the full SolarWinds deployment via the Settings > My Deployment menu. This action will update all related SolarWinds Platform products and scalability engines. Security teams should ensure that all components, including remote players with disabled automatic upgrades, are updated manually.
Additionally, organizations should assess server exposure, restrict management access to trusted networks, and monitor logs for unusual activity. Systems running older versions, such as Observability Self-Hosted 2024.2 and earlier, no longer receive support and should be upgraded immediately.
In summary, addressing these vulnerabilities promptly is crucial to maintaining security and integrity within affected systems. Organizations are encouraged to implement these updates to safeguard against potential threats.
