CVE-2026-28325 – SolarWinds Observability Self-Hosted
“When a monitoring platform can be taken over without a login, it no longer watches the network. It works for the attacker.”
SolarWinds has released fixes for two unauthenticated remote code execution vulnerabilities in Observability Self-Hosted. CVE-2026-28324 has a CVSS score of 9.8, Critical severity. It comes from insufficient integrity checks and affects installations running in a non-default, non-secure configuration. CVE-2026-28325 has a CVSS score of 8.8, High severity. It comes from deserialization of untrusted data when the application uses a specific communication mode.
Both flaws let an attacker who is not logged in run code on the monitoring server. These servers have wide visibility and privileged access across the environment, so a compromise exposes much more than one host. Apply the update to all self-hosted instances and review their configuration and communication mode settings.
Key Details
- Attack Vector
- Adjacent
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-502