SolarWinds Patches Two RCE Flaws in Observability Self-Hosted: Configuration Is the Deciding Factor

SolarWinds released Observability Self-Hosted 2026.2.3 on September 22, 2026, to address two unauthenticated remote code execution vulnerabilities. The severity is amplified by the nature of the product: an infrastructure monitoring platform with broad network visibility and privileged access that becomes a prime target when its defenses fail. Not every installation carries the same risk, and assessing exposure requires looking beyond the version number.

The Two Flaws: Integrity and Deserialization

The first vulnerability, CVE-2026-28324, carries a CVSS 9.8 rating per NVD and CNA sources. The National Vulnerability Database classifies it as CWE-345 (Insufficient Verification of Data Authenticity) with vector CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The documentation states the flaw resides in insufficient integrity checks that permit code execution on deployments with non-default, insecure configurations.

The second, CVE-2026-28325, rates CVSS 8.8 per HOL Guard and convergent sources. It stems from deserialization of untrusted data in a specific product communication mode. Both vulnerabilities are remotely exploitable without authentication, as confirmed by the NVD PR:N vector and six news outlets covering the release.

"SolarWinds has released patches for two severe vulnerabilities in Observability Self-Hosted that could be exploited for remote code execution (RCE)" — SecurityWeek

Why Configuration Matters More Than Version

The critical angle for infrastructure teams is the dependency on non-standard configurations. CVE-2026-28324 does not trigger on default installations: it explicitly requires customizations that have disabled or bypassed security controls. This creates a scenario where two environments running the same software version can have radically different risk profiles.

The technical reading is that SolarWinds Observability Self-Hosted, like many enterprise monitoring platforms, offers extensive configurability to fit heterogeneous architectures. That flexibility, when exercised without the vendor's intended security constraints, becomes attack surface. Decisions made years ago — for interoperability, legacy compatibility, or faster deployment — can resurface as active vulnerabilities when a flaw emerges that exploits them.

For CVE-2026-28325, the dossier does not specify the technical name of the vulnerable communication mode. The source indicates only that it is a particular operational configuration, not the standard setting. This gap in available documentation prevents building precise detection rules without internal verification of the specific deployment.

The Architectural Shift in WPM Players

The 2026.2.3 update goes beyond code fixes. According to SecurityOnline, GBHackers, and CyberSecurityNews, SolarWinds re-architected the Web Performance Monitor player communication model: passive players previously contacted by the main polling engine switch to a player-initiated mode, and remote passive players receive high-complexity random passwords.

This change has concrete operational consequences. Environments relying on distributed topologies with remote passive players must verify connectivity and credential management after the update. The modification is intrinsic to the vulnerability fix: reversing the communication initialization direction reduces the exposed surface on the server side, where the deserialization flaw resided.

CyberSecurityNews also reports that SolarWinds has ended engineering support for Observability Self-Hosted versions 2024.2 and earlier. Organizations on obsolete releases must plan a full upgrade, not just incremental patching.

Operational Priorities

Convergent sources indicate four operational priorities for teams managing SolarWinds Observability Self-Hosted:

• Verify the installed version against 2026.2.3: SecurityWeek, SecurityOnline, GBHackers, CyberSecurityNews, Strix.ai, and HOL Guard agree that all versions prior to 2026.2.3 are affected by both vulnerabilities.
• Map active non-standard configurations in your deployment: CVE-2026-28324's severity is conditioned on insecure configurations; the team must verify whether historical customizations have disabled integrity checks.
• Plan the transition of passive WPM players to the new topology: the update changes player behavior; sources document that passive players on the main polling engine become active and remote players receive random passwords.
• Evaluate a full upgrade for installations on 2024.2 or earlier: CyberSecurityNews documents the end of engineering support, which exposes organizations to the risk of missing future fixes.

Attribution, Disclosure, and Exploitation Status

Kai Huang of Armadin reported both vulnerabilities via responsible disclosure, as documented by SecurityWeek, GBHackers, and CyberSecurityNews. SolarWinds states there is no evidence of active exploitation at the time of patch publication. This statement does not constitute absolute confirmation of absence of exploitation: the dossier provides no technical details of the vulnerable endpoints, nor confirmation of public PoCs, leaving room for reverse-engineering attempts by malicious actors.

The precise timeline between reporting and release is not documented in available sources. No infrastructure overlaps emerge linking the described techniques to known campaigns or publicly tracked exploitation frameworks.

Why the SolarWinds Case Remains Sensitive

The combination of unauthenticated RCE in a monitoring platform with privileged access to the enterprise network makes this advisory board-relevant. The risk is not abstract: a compromise of SolarWinds Observability provides visibility into traffic, systems, and potentially credentials of monitored infrastructure. The vendor's prior history of supply-chain incidents amplifies organizational attention thresholds, even though the current flaws are of a different nature and configuration-linked.

The technical lesson is that for this vendor, risk assessment cannot stop at a CVE-versus-version matrix. It demands active configuration verification, documentation of historical customizations, and understanding of the operational implications of the architectural changes introduced with the patch.

Sources

• https://www.securityweek.com/solarwinds-patches-critical-rce-flaws-in-observability-self-hosted/
• https://securityonline.info/solarwinds-observability-vulnerabilities-fixed/
• https://www.strix.ai/cve/CVE-2026-28324
• https://hol.org/guard/security/cves/CVE-2026-28325-solarwinds-observability-self-hosted
• https://gbhackers.com/solarwinds-observability-flaws/amp/
• https://cybersecuritynews.com/solarwinds-flaws-execute-code-on-observability-servers/
• https://nvd.nist.gov/vuln/detail/CVE-2026-28324
• https://podcast.securityweek.com/

Information verified against cited sources and current as of publication.

Sources