SolarWinds has released an urgent security update addressing two remote code execution vulnerabilities in its Observability Self-Hosted platform. The flaws could allow unauthenticated attackers to execute malicious code on affected systems under specific configurations.
The vulnerabilities are tracked as CVE-2026-28324 and CVE-2026-28325. SolarWinds fixed both issues in Observability Self-Hosted version 2026.2.3, released on September 22, 2026.
Critical SolarWinds Vulnerability Receives 9.8 Rating
CVE-2026-28324 carries a critical CVSS score of 9.8. According to SolarWinds, insufficient integrity checks could allow an unauthenticated attacker to achieve remote code execution. However, the vulnerability only affects installations operating with a non-default and insecure configuration.
CVE-2026-28325 received a CVSS score of 8.8. This vulnerability involves the deserialization of untrusted data and could also enable unauthenticated code execution when the platform uses a particular communication mode.
Why These SolarWinds Flaws Matter
SolarWinds Observability Self-Hosted monitors networks, applications, servers and other critical infrastructure. A successful compromise of an observability platform could provide attackers with access to sensitive operational information and potentially create opportunities for lateral movement.
The configuration requirements reduce the number of immediately exploitable installations, but organizations should not assume they are protected without reviewing their environments. The vendor’s release notes do not report active exploitation of either vulnerability.
Administrators Should Install the Update
Organizations using SolarWinds Observability Self-Hosted should upgrade to version 2026.2.3 as soon as possible. Administrators should also review their communication settings and Web Performance Monitor player configurations.
The update changes some WPM communication behavior. Passive players installed on the main polling engine are switched to active, player-initiated communication after the upgrade. Remotely installed passive players receive randomly generated strong passwords during an automatic update.
Security teams should confirm that the upgrade completed across the entire deployment and monitor affected systems for unexplained processes, configuration changes or unusual network activity.