SolarWinds has released patches for two severe vulnerabilities in Observability Self-Hosted that could be exploited for remote code execution (RCE).
Observability Self-Hosted is an on-premises and hybrid IT monitoring solution that provides organizations with unified monitoring across environments, configuration management, and control over operational data and security compliance.
The first flaw, tracked as CVE-2026-28324 (CVSS score of 9.8), is an insufficient integrity check issue leading to RCE on deployments that run non-default and non-secure configurations.
Tracked as CVE-2026-28325 (CVSS score of 8.8), the second bug is described as a deserialization of untrusted data weakness affecting installations configured to use a specific communication mode.
Both security defects, SolarWinds says, can be exploited by remote attackers without authentication.
The vulnerabilities impact all Observability Self-Hosted versions up to 2026.2.2 and were addressed in version 2026.2.3. SolarWinds credited Kai Huang from Armadin for reporting both flaws.
Last week, the company patched another unauthenticated RCE bug reported by the security researcher.
Tracked as CVE-2026-28326 (CVSS score of 8.8) and affecting SolarWinds’s Access Rights Manager (ARM), it exists because ARM versions up to 2026.2 contain a hardcoded static key.
SolarWinds makes no mention of any of these security defects being exploited in the wild. Additional information is available on the company’s security advisories page.
Related: Critical WordPress Vulnerability Exploited Immediately After Disclosure
Related: Critical F5 BIG-IP Vulnerability Exploited as Zero-Day
Related: Check Point Patches Exploited Management Server Zero-Day
Related: Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity
