SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted

SolarWinds has shipped fixes for two high-impact security flaws in its Observability Self-Hosted monitoring platform, both of which could let unauthenticated remote attackers execute arbitrary code. The more severe issue, CVE-2026-28324 (CVSS 9.8), stems from an insufficient integrity check that becomes exploitable on instances running insecure, non-default settings. The second, CVE-2026-28325 (CVSS 8.8), involves unsafe deserialization of untrusted data on systems configured with a particular communication mode. Both bugs affect every Observability Self-Hosted release up to 2026.2.2 and are resolved in 2026.2.3; researcher Kai Huang of Armadin was credited with reporting them. This follows last week's fix for CVE-2026-28326 (CVSS 8.8) in SolarWinds Access Rights Manager up to version 2026.2, caused by a hardcoded static key that also allowed unauthenticated remote code execution. SolarWinds states none of these vulnerabilities have been observed being exploited in the wild, and customers are urged to apply the available updates.