Critical SolarWinds Flaws Enable Unauthenticated Remote Code Execution on Observability Servers

SolarWinds has issued an urgent security update, version 2026.2.3, to patch two critical vulnerabilities that could allow unauthenticated attackers to execute arbitrary code on its Observability Self-Hosted servers. The flaws, identified as CVE-2026-28324 and CVE-2026-28325, pose a significant risk, particularly to installations configured in non-default ways that involve Web Performance Monitor (WPM) players.

CVE-2026-28324, rated a critical 9.8 out of 10 on the CVSS scale, stems from insufficient integrity checks within the Observability Self-Hosted product when it's configured in a non-secure, non-default manner. This vulnerability allows a remote attacker to execute commands without any prior authentication, making it a prime target for exploitation. While specific proof-of-concept details have not been publicly disclosed, the high severity score underscores the immediate need for patching.

The second vulnerability, CVE-2026-28325, carries a CVSS score of 8.8 and also permits unauthenticated remote code execution. According to SolarWinds, this flaw arises from unsafe deserialization of untrusted data when the application operates in a specific communication mode. Unsafe deserialization is a common attack vector where applications process serialized data provided by an attacker without adequate validation, potentially leading to the execution of malicious code within the application's context.

Both vulnerabilities were responsibly reported by Kai Huang of Armadin. The security update, version 2026.2.3, does not introduce new features but focuses on critical security fixes and platform stability improvements. A notable change affects certain WPM player deployments: passive WPM players on the main polling engine will transition from server-initiated to player-initiated communication post-upgrade. Remote passive WPM players will receive randomly generated strong passwords, while those with the 'Enable Upgrade' option disabled will require manual administrator intervention.

SolarWinds advises administrators to thoroughly review their deployment configurations before applying the update. This includes identifying all main polling engines, remote WPM players, and the communication modes currently in use. Special attention should be paid to ensuring that passive remote players are secured with strong credentials and that any systems excluded from automatic upgrades are updated manually to mitigate potential risks.

To further enhance security, organizations should restrict management access to trusted networks, diligently monitor SolarWinds application and Windows logs for any signs of unexpected process execution, and investigate any abnormal activity related to polling engines or WPM players. The company also highlights that older versions, such as Observability Self-Hosted 2024.2 and earlier, are no longer supported and do not receive regular security fixes, making an upgrade even more critical for these deployments.

This incident serves as a stark reminder of the ongoing security challenges faced by complex IT management software. As organizations increasingly rely on integrated observability platforms, vulnerabilities within these systems can have far-reaching consequences, potentially compromising the very infrastructure they are designed to monitor. Prompt patching and rigorous security hygiene are paramount to defending against such threats.