SolarWinds Observability Self-Hosted RCE via Deserialization
CVSS 8.8 high. Unauthenticated RCE through deserialization of untrusted data in SolarWinds Observability Self-Hosted when using a specific communication mode.
- Vendor
- SolarWinds
- Product
- Observability Self-Hosted
- CVSS
- 8.8
- EPSS (exploit probability)
- 1.5%
- Status
- patched
- Published
SolarWinds Observability Self-Hosted before version 2026.2.3 contains an unauthenticated remote-code-execution vulnerability involving deserialization of untrusted data. The affected path is reachable when the application uses a specific communication mode. SolarWinds rates the issue high at CVSS 8.8.
The vendor’s advisory does not name the communication mode or publish exploitation steps. Administrators should therefore use the installed product version and configuration history, rather than assumptions about a default deployment, to determine exposure. The unauthenticated attack path makes internet- or broadly network-accessible management services the highest-priority systems to review.
Upgrade SolarWinds Observability Self-Hosted to 2026.2.3 or later. Until the update is applied, restrict access to the management plane and avoid exposing the service outside trusted administrative networks. Review SolarWinds’ release notes and secure-configuration documentation after updating. SolarWinds credits Kai Huang of Armadin with responsibly reporting the vulnerability.
