SolarWinds Observability Self-Hosted Unauth RCE
CVSS 9.8 critical. Unauthenticated RCE via insufficient integrity checks in SolarWinds Observability Self-Hosted; affects installations in non-default, non-secure configurations.
- Vendor
- SolarWinds
- Product
- Observability Self-Hosted
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.7%
- Status
- patched
- Published
SolarWinds Observability Self-Hosted before version 2026.2.3 contains an unauthenticated remote-code-execution vulnerability caused by insufficient integrity checks. SolarWinds rates the issue critical at CVSS 9.8. Exploitation requires an installation using what the vendor describes as a non-default, non-secure configuration.
The weakness is tracked as CWE-345, Insufficient Verification of Data Authenticity. A network-reachable attacker does not need an account or user interaction under the vendor’s CVSS assessment, and successful exploitation can compromise confidentiality, integrity, and availability. SolarWinds has not described the vulnerable configuration in its short CVE notice, so administrators should not infer safety from the configuration caveat alone.
Upgrade SolarWinds Observability Self-Hosted to 2026.2.3 or later and review the vendor’s secure-configuration guidance. Teams that cannot patch immediately should restrict network access to the management plane and confirm whether any non-default communication or integrity settings are enabled. SolarWinds credits Kai Huang of Armadin with responsibly reporting the flaw.
