CVE-2026-28324: Critical Unauthenticated RCE in SolarWinds Observability Self-Hosted

Summary

CVE-2026-28324 is a Critical-severity vulnerability in SolarWinds Observability Self-Hosted that enables unauthenticated remote code execution. The root cause is insufficient integrity checks within the product, classified under CWE-345 (Insufficient Verification of Data Authenticity). SolarWinds has confirmed that only installations configured in a non-default and non-secure configuration are affected, meaning deployments following the documented secure-configuration guidance are not exposed to this specific attack path.

The vulnerability carries a CVSS v3.1 base score of 9.8, derived from the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates a network-exploitable flaw requiring no privileges, no user interaction, and causing full impact to confidentiality, integrity, and availability. It represents one of the most severe vulnerability classes possible in a self-hosted monitoring platform.

Technical Analysis

The vulnerability stems from CWE-345, which describes scenarios where software does not sufficiently verify the authenticity or integrity of data before processing or acting upon it. In the context of SolarWinds Observability Self-Hosted, this means that certain components accept and process data or instructions without adequately validating that the source is legitimate or that the content has not been tampered with.

Because the vulnerability is unauthenticated and remotely exploitable over the network (AV:N), an attacker who can reach the affected instance does not need valid credentials or any prior access to the system. The attack complexity is rated Low (AC:L), meaning exploitation does not require special conditions or timing. No user interaction (UI:N) is needed, so the attack can proceed without any action from an authenticated user or administrator.

The scope is Unchanged (S:U), meaning the impact is confined to the vulnerable component itself rather than crossing into a different security authority. However, the impact ratings for confidentiality, integrity, and availability are all High (C:H/I:H/A:H), indicating that successful exploitation can result in full compromise of the affected system, including the ability to read sensitive data, modify or delete data, and disrupt services.

The critical detail in the advisory is that only non-default and non-secure configurations are affected. This strongly suggests that SolarWinds ships the product with secure defaults and provides documentation on how to maintain a secure configuration. Installations that deviate from these defaults, perhaps by exposing internal endpoints, disabling authentication checks, or using insecure communication channels, become vulnerable to this RCE path.

The insufficient integrity checks likely mean that a component within the Observability Self-Hosted platform processes incoming requests or data payloads without verifying their origin or ensuring they meet expected integrity standards. In a secure configuration, additional layers such as authentication, TLS, or integrity validation would prevent malicious payloads from reaching the vulnerable code path. In a non-secure configuration, those protective layers are absent or weakened, allowing an attacker to craft and deliver a payload that triggers arbitrary code execution.

Affected Software and Versions

The NVD entry for CVE-2026-28324 identifies the affected product as SolarWinds Observability Self-Hosted. The vendor and product fields in the NVD record do not specify granular version ranges. SolarWinds has released a security advisory and accompanying release notes that should be consulted for the definitive list of affected and fixed versions.

Product: SolarWinds Observability Self-Hosted
Vendor: SolarWinds
Configuration requirement: Only installations in a non-default and non-secure configuration are affected
Fixed version: Consult the HCO 2026.2.3 release notes referenced below

Administrators should review the official SolarWinds trust center advisory and the HCO 2026.2.3 release notes to determine whether their specific deployment and version combination is affected and to identify the appropriate remediation path.

Impact

The impact of CVE-2026-28324 is severe. With a CVSS score of 9.8, successful exploitation grants an unauthenticated remote attacker the ability to execute arbitrary code on the affected SolarWinds Observability Self-Hosted instance. The consequences include:

Confidentiality (High): An attacker can access sensitive monitoring data, configuration files, credentials stored within the platform, and information about the monitored infrastructure.
Integrity (High): An attacker can modify monitoring data, alter configurations, inject false telemetry, or tamper with alerts and dashboards to mask malicious activity in the environment.
Availability (High): An attacker can disrupt monitoring services, delete critical data, or crash the platform, leaving administrators blind to issues in their infrastructure.
Remote Code Execution: Beyond data-level impact, arbitrary code execution means the attacker can pivot within the network, establish persistence, and use the compromised instance as a launching point for further attacks against monitored systems.

Given that SolarWinds Observability Self-Hosted is a monitoring platform that often holds privileged credentials for the systems it monitors and may have broad network access, compromise of this platform can lead to lateral movement and escalation across the entire monitored environment.

Exploitation Scenario

An exploitation scenario for CVE-2026-28324 would involve an attacker identifying a SolarWinds Observability Self-Hosted instance that is configured in a non-default and non-secure manner. The following steps outline a plausible attack chain based on the vulnerability characteristics:

Reconnaissance: The attacker identifies an internet-facing or network-accessible instance of SolarWinds Observability Self-Hosted. This could be discovered through port scanning, DNS enumeration, or fingerprinting of the platform's web interface.
Configuration assessment: The attacker determines that the target is running in a non-secure configuration. This might involve observing that certain endpoints are accessible without authentication, that TLS is not enforced, or that integrity validation mechanisms appear to be disabled.
Payload delivery: Leveraging the insufficient integrity checks (CWE-345), the attacker sends a crafted request or data payload to a vulnerable component. Because the component does not adequately verify the authenticity or integrity of the incoming data, the malicious payload is accepted and processed.
Code execution: The processed payload triggers arbitrary code execution within the context of the SolarWinds Observability Self-Hosted application. The attacker now has control over the server process.
Post-exploitation: The attacker accesses stored credentials, modifies monitoring data to hide their tracks, pivots to monitored systems using the platform's privileged access, and establishes persistence within the environment.

This scenario underscores why the secure-configuration guidance from SolarWinds is critical. In a default secure configuration, the vulnerable code path would either be unreachable without authentication or protected by integrity validation that would reject the malicious payload.

Detection and Mitigation

Detection

Organizations should take the following steps to detect potential exploitation of CVE-2026-28324:

Review web server and application logs for unusual or unexpected requests to SolarWinds Observability Self-Hosted endpoints, particularly those that appear to bypass normal authentication flows.
Monitor for unexpected process execution or child processes spawned by the SolarWinds application service accounts.
Look for anomalous outbound network connections from the SolarWinds server, which may indicate post-exploitation activity or data exfiltration.
Check for unauthorized modifications to configuration files, monitoring templates, or alert definitions within the platform.
Review access to credential stores or secrets management systems accessed by the SolarWinds service accounts.

Mitigation

SolarWinds and the NVD provide the following remediation guidance:

Apply the fixed version: Upgrade to the version identified in the HCO 2026.2.3 release notes, which addresses the insufficient integrity checks described in CVE-2026-28324.
Review and enforce secure configuration: Consult the SolarWinds secure configuration documentation and ensure that all settings align with the recommended secure defaults. This is the primary mitigation for installations that cannot immediately upgrade.
Restrict network access: Limit access to the SolarWinds Observability Self-Hosted instance to trusted internal networks only. Do not expose the platform directly to the internet without additional protective controls such as VPN or reverse proxy with authentication.
Enable authentication on all endpoints: Verify that no endpoints are accessible without authentication. The vulnerability specifically affects non-secure configurations, so ensuring authentication is enforced everywhere reduces the attack surface.
Enforce TLS: Ensure all communication to and from the platform uses encrypted channels to prevent tampering with data in transit.
Monitor for configuration drift: Implement regular audits of the SolarWinds configuration to detect any deviations from the secure baseline that could re-introduce vulnerability.

Bug Bounty Angle

For security researchers and bug bounty participants, CVE-2026-28324 highlights several valuable lessons:

Configuration-dependent vulnerabilities are real: This vulnerability only manifests in non-default, non-secure configurations. Researchers should systematically test products under various configuration states, not just the default installation, to uncover vulnerabilities that emerge when security settings are relaxed.
Integrity checks matter: CWE-345 is a broad category that covers many real-world vulnerabilities. Researchers should examine how products validate incoming data, especially in components that handle file uploads, API requests, or inter-service communication. Missing or weak integrity validation can lead to RCE.
Unauthenticated attack surfaces: The most impactful vulnerabilities are often those reachable without credentials. Mapping all unauthenticated endpoints and data flows in a product can reveal high-severity issues.
Monitoring platforms are high-value targets: Products like SolarWinds Observability that hold credentials and have broad network access are prime targets. Researchers should prioritize these types of products in their testing programs.
Secure defaults vs. insecure options: When a vendor ships secure defaults but allows users to disable them, the resulting configuration-dependent vulnerabilities can still be highly impactful and worthy of reporting.

Frequently Asked Questions

Q: What is CVE-2026-28324?

A: CVE-2026-28324 is a Critical unauthenticated remote code execution vulnerability in SolarWinds Observability Self-Hosted caused by insufficient integrity checks (CWE-345). It has a CVSS score of 9.8 and affects installations in non-default, non-secure configurations.

Q: Which configurations are affected?

A: Only SolarWinds Observability Self-Hosted installations configured in a non-default and non-secure configuration are affected. Installations following the documented secure-configuration guidance from SolarWinds are not exposed to this vulnerability.

Q: How should organizations remediate this vulnerability?

A: Organizations should upgrade to the fixed version referenced in the HCO 2026.2.3 release notes and ensure their deployment follows the SolarWinds secure configuration documentation. Restricting network access to the platform and enforcing authentication on all endpoints are also critical mitigation steps.