Critical SolarWinds Observability RCE Flaws Patched

Key Takeaways

• SolarWinds has issued a critical patch for its Observability Self-Hosted platform.
• Two severe remote code execution (RCE) vulnerabilities, CVE-2026-28324 and CVE-2026-28325, have been addressed.
• These flaws could allow unauthenticated attackers to execute arbitrary code on affected servers.
• The vulnerabilities primarily impact specific non-default configurations and installations utilizing Web Performance Monitor (WPM) players.
• Organizations should immediately update to Observability Self-Hosted version 2026.2.3.

Critical RCE Flaws Patched in SolarWinds Observability Self-Hosted

SolarWinds has released an urgent security update, Observability Self-Hosted version 2026.2.3, to mitigate two critical vulnerabilities that could enable unauthenticated remote code execution (RCE) on susceptible servers. These flaws, identified as CVE-2026-28324 and CVE-2026-28325, pose a significant risk, particularly to deployments configured in non-default modes or those integrating Web Performance Monitor (WPM) players.

The patch, rolled out on September 22, 2026, is crucial for organizations utilizing SolarWinds Observability Self-Hosted, especially those with WPM players in their environment. Successful exploitation of these vulnerabilities could grant remote attackers the ability to execute arbitrary commands on a server without prior authentication.

Deep Dive into the Vulnerabilities

CVE-2026-28324, the more severe of the two, carries a CVSS score of 9.8 out of 10, categorizing it as a critical issue. SolarWinds indicated that this vulnerability stems from inadequate integrity checks within Observability Self-Hosted installations that are configured in a non-default, less secure manner.

While SolarWinds has not publicly disclosed proof-of-concept details, the high CVSS score underscores the urgency for defenders to prioritize patching for any exposed and specifically configured servers. The second vulnerability, CVE-2026-28325, is also an unauthenticated RCE issue, rated with a CVSS score of 8.8.

According to SolarWinds, CVE-2026-28325 arises from unsafe deserialization of untrusted data when the application operates in a particular communication mode. Unsafe deserialization vulnerabilities occur when an application processes serialized data provided by an attacker without adequate validation, potentially leading to the execution of malicious objects or commands within the application’s context.

Both vulnerabilities were responsibly reported by Kai Huang of Armadin. SolarWinds confirms that these issues are resolved in version 2026.2.3, which focuses on security fixes and platform reliability enhancements rather than new features.

Post-Upgrade Considerations for WPM Deployments

The update also introduces changes to the behavior of certain WPM player deployments. Specifically, passive WPM players that are installed by default on the main polling engine will transition from server-initiated to player-initiated communication post-upgrade.

Remote passive WPM players will automatically receive randomly generated strong passwords during their upgrade process. However, SolarWinds noted that players with the “Enable Upgrade” option disabled will not be automatically updated and require manual intervention from administrators. Active, player-initiated WPM players do not require a password following the upgrade.

What You Should Do

• Immediate Patching: Administrators must upgrade their entire SolarWinds deployment to Observability Self-Hosted version 2026.2.3 without delay. This can be done via Settings > My Deployment, which updates both SolarWinds Platform products and associated scalability engines.
• Inventory and Assessment: Before applying the update, security teams should identify all main polling engines, remote WPM players, and the communication modes currently in use within their environment.
• Credential Review: Verify that all passive remote WPM players have strong, unique credentials, especially those that might not be automatically upgraded.
• Manual Updates: Ensure that any systems excluded from automatic upgrades are updated manually.
• Exposure Review: Assess server exposure and restrict management access to trusted networks only.
• Logging and Monitoring: Continuously monitor SolarWinds application and Windows logs for any unexpected process execution or abnormal activity involving polling engines or WPM players.
• End-of-Life Systems: Pay particular attention to older deployments. SolarWinds has ceased engineering support for Observability Self-Hosted 2024.2 and earlier versions, meaning these will no longer receive regular fixes or service releases and should be upgraded or decommissioned.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.