SolarWinds Observability Self-Hosted Unauth RCE
CVSS 9.8 critical. Unauthenticated RCE via insufficient integrity checks in SolarWinds Observability Self-Hosted; affects installations in non-default, non-secure configurations.
- Vendor
- SolarWinds
- Product
- Observability Self-Hosted
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.7%
- Status
- patched
- Published
Is CVE-2026-28324 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-28324 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-11 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.7% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-11. Full cross-catalog view: /kev-comparison
CVE-2026-28324 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
SolarWinds Observability Self-Hosted before version 2026.2.3 contains an unauthenticated remote-code-execution vulnerability caused by insufficient integrity checks. SolarWinds rates the issue critical at CVSS 9.8. Exploitation requires an installation using what the vendor describes as a non-default, non-secure configuration.
The weakness is tracked as CWE-345, Insufficient Verification of Data Authenticity. A network-reachable attacker does not need an account or user interaction under the vendor’s CVSS assessment, and successful exploitation can compromise confidentiality, integrity, and availability. SolarWinds has not described the vulnerable configuration in its short CVE notice, so administrators should not infer safety from the configuration caveat alone.
Upgrade SolarWinds Observability Self-Hosted to 2026.2.3 or later and review the vendor’s secure-configuration guidance. Teams that cannot patch immediately should restrict network access to the management plane and confirm whether any non-default communication or integrity settings are enabled. SolarWinds credits Kai Huang of Armadin with responsibly reporting the flaw.
Other SolarWinds CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-28325 SolarWinds Observability Self-Hosted RCE via Deserializationwrite-up | [ HIGH ] | 8.8 | 1.5% | — |
| CVE-2026-28326 SolarWinds ARM hard-coded key enables unauthenticated RCEwrite-up | [ HIGH ] | 8.8 | 0.7% | — |
| CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability | [ HIGH ] | 7.5 | 48.0% | |
| CVE-2025-26399 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 90.6% | |
| CVE-2025-40536 SolarWinds Web Help Desk Security Control Bypass Vulnerability | [ HIGH ] | 8.1 | 73.6% | |
| CVE-2025-40551 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 84.2% | |
| CVE-2024-28987 SolarWinds Web Help Desk Hardcoded Credential Vulnerability | [ CRITICAL ] | 9.1 | 93.3% | |
| CVE-2024-28986 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 84.6% |
