SolarWinds Observability RCE flaws patched
SolarWinds patched two unauthenticated RCE vulnerabilities in Observability Self-Hosted, one via unsafe deserialization, CVSS up to 9.8.
NCSC-NL published an advisory covering two vulnerabilities in SolarWinds Observability Self-Hosted that allow unauthenticated remote code execution. CVE-2026-28324 (CVSS 9.8) stems from deserialization of untrusted data when a specific communication mode is in use. CVE-2026-28325 (CVSS 8.8) results from insufficient integrity checks, primarily affecting installations that deviate from default configurations and use insecure settings.
Both issues allow an attacker to execute arbitrary code remotely without authentication, making them serious risks for exposed instances. SolarWinds has released updates addressing both vulnerabilities. No in-the-wild exploitation is mentioned in the advisory. Defenders running SolarWinds Observability Self-Hosted should apply the vendor updates promptly, review configuration against SolarWinds' hardening guidance, and ensure any non-default or insecure communication settings are remediated.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0388.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free