SolarWinds has issued security updates for two critical vulnerabilities in its Observability Self-Hosted product that could enable remote code execution without authentication. The flaws, tracked as CVE-2026-28324 and CVE-2026-28325, are present in multiple versions of the IT monitoring solution and have been patched in the latest release.
Observability Self-Hosted is an on-premises and hybrid IT monitoring platform that enables organizations to centrally monitor their environments.
It also features configuration management and control over operations data and security compliance.
The first vulnerability, CVE-2026-28324, has a CVSS score of 9.8 and is described as an insufficient integrity check leading to remote code execution. SolarWinds reported that the problem affects deployments that use a non-default and non-secure configuration. Since the weakness is an unauthenticated remote code execution (RCE) vulnerability, SolarWinds warned that such deployments could be at risk of exploitation.
The second flaw, CVE-2026-28325, has a CVSS score of 8.8 and is described as a deserialization of untrusted data issue that affects the instances of the application running in a specific communication mode. The company stated that it also allows for an unauthenticated RCE, meaning that the affected systems could be compromised by an attacker.
Both weaknesses impact Observability Self-Hosted up to and including version 2026.2.2. SolarWinds has already released updates in the 2026.2.3 version of the product which resolves the identified issues.
The company credited Kai Huang of Armadin for reporting the problems.
The recent updates to Observability Self-Hosted follow the patch for an unauthenticated RCE vulnerability in SolarWinds Access Rights Manager (ARM). The flaw, tracked as CVE-2026-28326, has a CVSS score of 8.8 and impacts ARM versions up to and including 2026.2. This vulnerability also resides in a hardcoded static key for the affected system version.
SolarWinds released the patch for CVE-2026-28326 last week after receiving the report from the anonymous security researcher.
According to the company, this is the third high-severity flaw discovered in its products this year. Moreover, SolarWinds warned that all three could be actively exploited.
However, the company added that there were no reports of exploitation for any of the three vulnerabilities. More information on the discovered issues can be found in the company’s advisory.
The affected organizations should update their Observability Self-Hosted instances to version 2026.2.3 as it includes the fixes for two newly discovered RCE flaws. In particular, the update is recommended for the deployments that feature the non-default, insecure configurations described by the vendor.
Read the original article: