The monitoring system, which should monitor the corporate infrastructure, itself can open the attacking road inside the network. SolarWinds has closed a critical vulnerability in Observability Self-Hosted, allowing you to remotely run code without a password and account.
The problem was received by CVE-2026-28324 and a score of 9.8 out of 10 on CVSS. The attack does not require rights in the system or the actions of the user, and the complexity of exploitation is considered low. The vulnerability is associated with insufficient verification of data integrity and in the worst case, it allows you to gain control over the server through remote code start.
There is a significant limitation. CVE-2026-28324 only works in Observability Self-Hosted installations with a non-standard configuration that SolarWinds considers unsafe. The company did not disclose a detailed scheme of the attack in order not to simplify the exploitation of vulnerable systems. The versions of 2026.2.2 and earlier are threatened, the correction was included in the issue of 2026.2.3.
In the same update, the developers fixed another similar problem, CVE-2026-28325 with a score of 8.8. Here the reason was the deselessation of untrusted data. The attack also does not require authentication, but is possible only when using a certain mode of communication between the components of the platform.
Both vulnerabilities were discovered by Kai Huang of Armadin. SolarWinds did not report cases of their exploitation in real attacks. Administrators are advised to install Observability Self-Hosted 2026.2.3 and check the platform configuration, especially if the communication and interaction settings of the components have changed relative to the default values.
In the published safety bulletin, SolarWinds classifies CVE-2026-28324 as critical. On the CVSS vector, the attacker can work through the network without having any privileges, and successful operation can completely violate the privacy, integrity and accessibility of the system. Update 2026.2.3 was released on September 22, 2026.
For SolarWinds, vulnerabilities without authentication have already become a real entry point to corporate networks. In early 2026, attackers attacked Web Help Desk, after which they developed penetration up to the theft of domain credentials and securing with SYSTEM rights.
In June, another problem was affected by the Serv-U file server. The attack also did not require a password or account, and CISA later confirmed the exploitation of the vulnerability in real attacks and added it to the Known Exploited Vulnerabilities catalog.
The story of SolarWinds remains particularly sensitive due to the large-scale compromise of Orion in 2020. Published in 2026, the documents showed that the participants of that campaign were able to read the mail of the U.S. Department of Finance for months, so new mistakes in the company's products traditionally attract increased attention of corporate network defenders.
The problem was received by CVE-2026-28324 and a score of 9.8 out of 10 on CVSS. The attack does not require rights in the system or the actions of the user, and the complexity of exploitation is considered low. The vulnerability is associated with insufficient verification of data integrity and in the worst case, it allows you to gain control over the server through remote code start.
There is a significant limitation. CVE-2026-28324 only works in Observability Self-Hosted installations with a non-standard configuration that SolarWinds considers unsafe. The company did not disclose a detailed scheme of the attack in order not to simplify the exploitation of vulnerable systems. The versions of 2026.2.2 and earlier are threatened, the correction was included in the issue of 2026.2.3.
In the same update, the developers fixed another similar problem, CVE-2026-28325 with a score of 8.8. Here the reason was the deselessation of untrusted data. The attack also does not require authentication, but is possible only when using a certain mode of communication between the components of the platform.
Both vulnerabilities were discovered by Kai Huang of Armadin. SolarWinds did not report cases of their exploitation in real attacks. Administrators are advised to install Observability Self-Hosted 2026.2.3 and check the platform configuration, especially if the communication and interaction settings of the components have changed relative to the default values.
In the published safety bulletin, SolarWinds classifies CVE-2026-28324 as critical. On the CVSS vector, the attacker can work through the network without having any privileges, and successful operation can completely violate the privacy, integrity and accessibility of the system. Update 2026.2.3 was released on September 22, 2026.
For SolarWinds, vulnerabilities without authentication have already become a real entry point to corporate networks. In early 2026, attackers attacked Web Help Desk, after which they developed penetration up to the theft of domain credentials and securing with SYSTEM rights.
In June, another problem was affected by the Serv-U file server. The attack also did not require a password or account, and CISA later confirmed the exploitation of the vulnerability in real attacks and added it to the Known Exploited Vulnerabilities catalog.
The story of SolarWinds remains particularly sensitive due to the large-scale compromise of Orion in 2020. Published in 2026, the documents showed that the participants of that campaign were able to read the mail of the U.S. Department of Finance for months, so new mistakes in the company's products traditionally attract increased attention of corporate network defenders.
