SolarWinds released fixes for two severe security flaws in its Observability Self-Hosted monitoring platform that could let attackers run code on vulnerable servers without logging in. The bugs are CVE-2026-28324 and CVE-2026-28325, affecting all versions up to 2026.2.2 and fixed in 2026.2.3. SolarWinds says exploitation depends on certain non-default configurations or a specific communication mode, and it has not reported active exploitation.
Why it matters: Organizations running this on-premises SolarWinds product could face full server compromise if they delay updates. Admins should identify affected deployments, review whether risky configurations are enabled, and update to 2026.2.3 as soon as possible.
Ionut Arghire
2026.09.24
100% relevant
This article is the initial report of CVE-2026-28324 and CVE-2026-28325 in SolarWinds Observability Self-Hosted and the vendor patch release for version 2026.2.3.
← Back to all stories