CVE-2026-28324 is an unauthenticated remote code execution flaw in SolarWinds Observability Self-Hosted, caused by insufficient integrity checks. It scores 9.8. SolarWinds says only installations in a non-default and non-secure configuration are affected. Versions 2026.2.2 and below are affected, and 2026.2.3 is the fix.
What's affected
SolarWinds' security advisory, first published 22 September 2026, says:
- Affected: SolarWinds Observability Self-Hosted 2026.2.2 and below
- Fixed: SolarWinds Observability Self-Hosted 2026.2.3
- Condition: installations configured in a non-default and non-secure configuration
The advisory does not spell out which settings count as non-default and non-secure. SolarWinds links its secure configuration guide for the platform in the NVD references, so use that to review your own deployment.
The 2026.2.3 release notes list two security fixes from the same reporter. This CVE is one. The other, CVE-2026-28325, is described as an unauthenticated remote code execution flaw stemming from deserialization of untrusted data when the application uses a specific communication mode, scored 8.8. If you upgrade for one, you pick up the other.
SolarWinds Observability SaaS is a different product from Self-Hosted. The advisory is about Self-Hosted only.
How to check if you're exposed
Find your version in the product's administration interface and compare it with 2026.2.2. Anything at or below 2026.2.2 is affected, subject to the configuration condition.
Then work through your configuration with SolarWinds' secure configuration guide for the platform, because the advisory ties exposure to a non-default, non-secure setup. Pay attention to anything that changed from the defaults when the product was installed or when remote collectors were added, and to which networks can reach the server and its collectors.
Finally, list who can reach the server over the network. A monitoring server often sits in a privileged position with credentials for many other systems, so its exposure matters beyond itself.
What to do now
- Upgrade SolarWinds Observability Self-Hosted to 2026.2.3 or later, following the release notes.
- Review your configuration against SolarWinds' secure configuration guide and revert any non-default settings you do not need.
- Restrict network access to the server and its communication ports to the systems that must reach them.
- Review the server for unexpected processes, services and scheduled tasks. The advisory gives no indicators, so use your normal host investigation checks.
- Treat credentials stored in the monitoring platform as sensitive. If you suspect exposure, rotate them.
Why it matters
The weakness is CWE-345 (Insufficient Verification of Data Authenticity). A system accepted data without proving who sent it or that it had not been changed. When the data triggers execution, as it does here according to the advisory, that gap becomes remote code execution without a login.
Two facts pull in opposite directions. The advisory says an unauthenticated attacker can run code remotely, which is the most serious outcome. It also says only non-default, non-secure configurations are affected, which narrows who is exposed. Both are true, and the right response is to check your configuration, not to assume either that you are safe or that you are not.
Monitoring platforms are attractive targets. They collect from the whole estate, hold credentials for polling, and are trusted by the network. A compromise of the monitoring server is a good starting point for lateral movement. That is why this class of product deserves the same patch discipline as an identity system.
The record does not flag exploitation in the wild, and the CVE is not in CISA's Known Exploited Vulnerabilities catalog. SolarWinds credits an outside researcher for the report. The fix is available, so the cost of acting now is a planned upgrade.
Quick check
Am I affected if I use the default configuration?
SolarWinds says installations configured in a non-default and non-secure configuration are affected. It does not list the settings, so review your deployment against the secure configuration guide, and upgrade to 2026.2.3 in any case.
Is the SaaS version affected?
The advisory names SolarWinds Observability Self-Hosted 2026.2.2 and below. It does not name the SaaS product.
What else is fixed in 2026.2.3?
The release notes also list CVE-2026-28325, a deserialization based remote code execution flaw in a specific communication mode, scored 8.8.
Sources
- SolarWinds security advisory CVE-2026-28324
- SolarWinds Observability Self-Hosted 2026.2.3 release notes
- Secure Configuration for the SolarWinds Platform
Last reviewed: 19 October 2026.
