cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

SolarWinds Patches Unauthenticated RCE Flaws in Observability Self-Hosted

· Original article ↗

Summary

SolarWinds patched two unauthenticated RCE vulnerabilities in Observability Self-Hosted, affecting versions through 2026.2.2, and a separate hardcoded-key RCE flaw in Access Rights Manager. The company reported no known exploitation in the wild.

Key points

  • CVE-2026-28324 (CVSS 9.8) involves an insufficient integrity check and affects deployments with non-default, non-secure configurations.
  • CVE-2026-28325 (CVSS 8.8) is a deserialization weakness affecting installations using a specific communication mode.
  • Both Observability Self-Hosted flaws can be exploited remotely without authentication; versions through 2026.2.2 are affected.
  • SolarWinds addressed the Observability Self-Hosted vulnerabilities in version 2026.2.3.
  • A separate unauthenticated RCE flaw, CVE-2026-28326 (CVSS 8.8), affects Access Rights Manager versions through 2026.2 and stems from a hardcoded static key.
  • SolarWinds credited Kai Huang of Armadin with reporting the flaws and did not mention exploitation in the wild.

Article Details

Vulnerability Types
  • Insufficient integrity check leading to remote code execution
  • Deserialization of untrusted data
  • Hardcoded static key
Severity
Critical (CVSS 9.8) and high (CVSS 8.8)
Affected Versions
  • Observability Self-Hosted: versions up to 2026.2.2
  • Access Rights Manager (ARM): versions up to 2026.2
Exploitation Status
not_reported
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-28324The first flaw, tracked as CVE-2026-28324 (CVSS score of 9.8), is an insufficient integrity check issue leading to RCE on deployments that run non-default and non-secure configurations.CVE-2026-28325Tracked as CVE-2026-28325 (CVSS score of 8.8), the second bug is described as a deserialization of untrusted data weakness affecting installations configured to use a specific communication mode.CVE-2026-28326Tracked as CVE-2026-28326 (CVSS score of 8.8) and affecting SolarWinds’s Access Rights Manager (ARM), it exists because ARM versions up to 2026.2 contain a hardcoded static key.

People

Kai HuangCredited by SolarWinds for reporting CVE-2026-28324 and CVE-2026-28325.

Vendors

SolarWindsSolarWinds has released patches for two severe vulnerabilities in Observability Self-Hosted that could be exploited for remote code execution (RCE).

Products

Access Rights ManagerTracked as CVE-2026-28326 (CVSS score of 8.8) and affecting SolarWinds’s Access Rights Manager (ARM), it exists because ARM versions up to 2026.2 contain a hardcoded static key.Observability Self-HostedSolarWinds has released patches for two severe vulnerabilities in Observability Self-Hosted that could be exploited for remote code execution (RCE).

Related Articles