SolarWinds Observability Self-Hosted RCE via Deserialization

CVSS 8.8 high. Unauthenticated RCE through deserialization of untrusted data in SolarWinds Observability Self-Hosted when using a specific communication mode.

cat cve-2026-28325.json

Vendor: SolarWinds
Product: Observability Self-Hosted
CVSS: 8.8
EPSS (exploit probability): 1.5%
Status: patched
Published: September 22, 2026
Source: https://nvd.nist.gov/vuln/detail/CVE-2026-28325

Related coverage

~/articles/2026-09-24-solarwinds-observability-cve-2026-28324-28325-rce

solarwinds

SolarWinds Fixes Two Unauth RCE Flaws in Observability

SolarWinds patches CVE-2026-28324 (CVSS 9.8) and CVE-2026-28325 (CVSS 8.8), two unauthenticated RCE flaws in Observability Self-Hosted. No active exploitation reported.

Sep 24read →