SolarWinds Observability Self-Hosted RCE via Deserialization
CVSS 8.8 high. Unauthenticated RCE through deserialization of untrusted data in SolarWinds Observability Self-Hosted when using a specific communication mode.
- Vendor
- SolarWinds
- Product
- Observability Self-Hosted
- CVSS
- 8.8
- EPSS (exploit probability)
- 1.5%
- Status
- patched
- Published
Is CVE-2026-28325 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-28325 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-11 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.5% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-11. Full cross-catalog view: /kev-comparison
CVE-2026-28325 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
SolarWinds Observability Self-Hosted before version 2026.2.3 contains an unauthenticated remote-code-execution vulnerability involving deserialization of untrusted data. The affected path is reachable when the application uses a specific communication mode. SolarWinds rates the issue high at CVSS 8.8.
The vendor’s advisory does not name the communication mode or publish exploitation steps. Administrators should therefore use the installed product version and configuration history, rather than assumptions about a default deployment, to determine exposure. The unauthenticated attack path makes internet- or broadly network-accessible management services the highest-priority systems to review.
Upgrade SolarWinds Observability Self-Hosted to 2026.2.3 or later. Until the update is applied, restrict access to the management plane and avoid exposing the service outside trusted administrative networks. Review SolarWinds’ release notes and secure-configuration documentation after updating. SolarWinds credits Kai Huang of Armadin with responsibly reporting the vulnerability.
Other SolarWinds CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-28324 SolarWinds Observability Self-Hosted Unauth RCEwrite-up | [ CRITICAL ] | 9.8 | 0.7% | — |
| CVE-2026-28326 SolarWinds ARM hard-coded key enables unauthenticated RCEwrite-up | [ HIGH ] | 8.8 | 0.7% | — |
| CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability | [ HIGH ] | 7.5 | 48.0% | |
| CVE-2025-26399 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerabilityransomware use | [ CRITICAL ] | 9.8 | 90.6% | |
| CVE-2025-40536 SolarWinds Web Help Desk Security Control Bypass Vulnerability | [ HIGH ] | 8.1 | 73.6% | |
| CVE-2025-40551 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 84.2% | |
| CVE-2024-28987 SolarWinds Web Help Desk Hardcoded Credential Vulnerability | [ CRITICAL ] | 9.1 | 93.3% | |
| CVE-2024-28986 SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability | [ CRITICAL ] | 9.8 | 84.6% |
