SolarWinds Observability Self-Hosted Unauth RCE

CVSS 9.8 critical. Unauthenticated RCE via insufficient integrity checks in SolarWinds Observability Self-Hosted; affects installations in non-default, non-secure configurations.

cat cve-2026-28324.json

Vendor: SolarWinds
Product: Observability Self-Hosted
CVSS: 9.8
EPSS (exploit probability): 0.7%
Status: patched
Published: September 22, 2026
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-28324

Related coverage

~/articles/2026-09-24-solarwinds-observability-cve-2026-28324-28325-rce

solarwinds

SolarWinds Fixes Two Unauth RCE Flaws in Observability

SolarWinds patches CVE-2026-28324 (CVSS 9.8) and CVE-2026-28325 (CVSS 8.8), two unauthenticated RCE flaws in Observability Self-Hosted. No active exploitation reported.

Sep 24read →