SolarWinds Observability Self-Hosted: Two Pre-Authentication RCE Vulnerabilities Fixed with Different Configuration Requirements

1. Basic Information

• Original Title: SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability (CVE-2026-28324)
• Source: SolarWinds
• Published: September 22, 2026
• Updated: None
• Collected: September 25, 2026, 08:28:50 JST
• Severity: Critical
• Severity Rationale: These are pre-authentication remote code execution vulnerabilities with CVSS v3.1 scores of 9.8 for CVE-2026-28324 and 8.8 for CVE-2026-28325. While active exploitation has not been confirmed, they can impact the privileges and accessible destinations of monitoring infrastructure, so this report rates the overall severity as critical.
• Original Link: SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability (CVE-2026-28324)
• Related Sources: SolarWinds: CVE-2026-28325 advisory, SolarWinds patches critical RCE flaws in Observability Self-Hosted
• CVEs: CVE-2026-28324, CVE-2026-28325
• Affected Products/Services: SolarWinds Observability Self-Hosted 2026.2.2 and earlier, SolarWinds Observability Self-Hosted 2026.2.3

2. Quick Summary

SolarWinds has patched two pre-authentication RCE vulnerabilities in Observability Self-Hosted. CVE-2026-28324 requires an insecure, non-standard configuration, while CVE-2026-28325 requires a specific communication mode and network adjacency. Both flaws are addressed in version 2026.2.3.

3. Attack Flow

This section describes the mechanics explained in public disclosures. The distinction between researcher verification, implementation analysis, and actual exploitation is detailed in "Attack Success Determination."

CVE-2026-28324: Insecure Non-Standard Configuration

1. An attacker reaches an unpatched system running an affected non-standard configuration.
2. The flaw, involving improper integrity checks, can be exploited to achieve pre-authentication code execution. Specific request details and attack paths have not been publicly disclosed.

CVE-2026-28325: Deserialization in a Specific Communication Mode

1. An attacker reaches an unpatched system using an affected communication mode from an adjacent network.
2. The vulnerability, involving insecure deserialization of untrusted data, can be exploited to achieve pre-authentication code execution. There are no reports of observed active attack procedures.

4. Attacker Position and Execution Location

• CVE-2026-28324 assumes an unauthenticated attacker reaching the target process over the network.
• CVE-2026-28325 carries the official CVSS Adjacent requirement, meaning it cannot be generalized as directly executable from any source on the internet.
• Subsequent actions may execute with the privileges of the affected service, though details regarding specific services and execution paths remain unpublished.

5. Victim and Administrator Perspective

Victims

• There are no reports indicating that general user interaction is required.

Administrators

• Abnormal service termination, suspicious child processes, configuration modifications, and external communications warrant investigation. These represent investigative viewpoints rather than published IOCs specific to this issue.

6. Success and Failure Conditions

Success Conditions

• Reaching the target process on an unpatched environment running version 2026.2.2 or earlier.
• For CVE-2026-28324, the presence of an insecure non-standard configuration.
• For CVE-2026-28325, the use of a specific communication mode combined with network adjacency access.

Failure Conditions and Risk Mitigation

• Update to version 2026.2.3 or a subsequent release designated by the vendor as containing the fix.
• Until updating, verify affected configurations and communication modes with the vendor, and restrict communication sources and paths. Blocking administrative interfaces alone may not protect all target processes.
• Minimize monitoring service credentials and destination privileges to limit the blast radius in the event of a compromise.

7. Impact Upon Success

• Environments meeting the conditions may be exposed to pre-authentication remote code execution.
• Inference: Configurations, credentials, and accessible destinations associated with the monitoring infrastructure could be impacted. This does not imply that individual data theft or lateral movement has been observed.

8. Observable Logs

The following outlines investigative and detection perspectives for internal security teams. This does not imply that all indicators were observed in public incidents.

Email

• There is no public information indicating that email was used for initial access.

Proxy, SWG, and DNS

• Check for requests directed at affected communication paths and suspicious external connections originating from the monitoring server.

Endpoint and EDR

• Preserve service anomalies, child processes, newly created files, and persistence configurations.

Authentication and IdP

• Check for subsequent use of credentials or administrator accounts assigned to the monitoring service.

SaaS and Cloud

• Review monitoring configurations, administrative actions, and the permissions and audit logs of integrated services.

Network

• Identify access paths for each CVE and inspect connections to target processes as well as internal and external communications.

9. Attack Success Determination

Scope Confirmed in Public Information

The vendor has published vulnerabilities and patched versions. There are no reports confirming active exploitation or code execution in individual environments.

Internal Determination Criteria

• Initial Execution Criteria: Criteria: Correlate suspicious incoming request processing with execution evidence such as service child processes and file creation. Public information contains no reports confirming active exploitation. (Scope: Organization's vulnerable services.)
• Subsequent Compromise Criteria: Criteria: Confirm additional evidence of credential usage following code execution, configuration changes, or interactions with secondary systems. (Scope: Investigated environment; not a published attack record.)

10. Investigation Playbook

The following recommendations for investigation and mitigation are based on public information.

Investigation Starting Point

• Triggered by the discovery of affected versions/configurations or anomalies in the monitoring service.

Initial Verification

• Verify software version, non-standard settings, communication modes, connection sources, and update status.

Endpoints and Servers

• Preserve service logs, processes, files, configurations, and network records.

Authentication and Cloud

• Review permissions and usage history for monitoring accounts and integrated credentials.

Subsequent Activity

• Inspect for configuration tampering, credential access, and abnormal operations targeting monitored systems.

Containment

• Restrict target communications while considering potential impacts on necessary monitoring functions, and update to the patched version. If compromise is suspected, proceed with isolation, recovery, and credential rotation.

Determination Categories

• Differentiate between vulnerable configurations, requests, code execution, data retrieval, and subsequent compromise.

11. Defense and Detection Ideas

The following recommendations for investigation and mitigation are based on public information.

Single Events

• Detect unexpected child processes or executable file creation originating from the monitoring service.

Timeline Correlation

• Correlate anomalies in incoming request handling with child processes, configuration changes, and external communications.

Threat Hunting

• Identify assets with affected versions and configurations, and inspect pre-update service logs and credential usage.

Log Limitations

• Official IOCs and request formats have not been published. General anomalies alone cannot confirm exploitation of these CVEs.

Priority Mitigations

• Prioritize patch application, restricting communication paths per CVE, and enforcing the principle of least privilege for monitoring accounts.

12. Facts / Inference / Hypothesis

Facts

• CVE-2026-28324 is a pre-authentication RCE caused by improper integrity checks and occurs in insecure non-standard configurations. The CVSS v3.1 score is 9.8 with a Network attack vector.
• CVE-2026-28325 involves insecure deserialization of untrusted data in a specific communication mode, leading to pre-authentication RCE. The CVSS v3.1 score is 8.8 with an Adjacent attack vector.
• Both vulnerabilities affect versions 2026.2.2 and earlier, with version 2026.2.3 serving as the fix.
• The official advisory was published on September 22, 2026. Active exploitation, individual victim environments, and subsequent payloads have not been publicly disclosed.

Inference

• Even for pre-authentication RCE vulnerabilities in the same product, configurations and network conditions differ. Prioritization requires combining version, communication mode, and reachability assessments rather than relying solely on asset counts.

Hypothesis

No additional hypotheses. Unverified items are documented in "Unknowns and Further Investigation."

13. MITRE ATT&CK Mapping

Specific exploitation paths and attack behaviors cannot be sufficiently identified from public information; mapping is withheld.

14. Unknowns and Further Investigation

• Details of affected non-standard configurations, communication modes, and specific attack requests.
• Presence of active exploitation, victim organizations, and subsequent payloads.
• Privileges within individual environments and the potential blast radius across monitored targets.

15. Impact on SOCs and Organizations

Verify Observability Self-Hosted versions and configurations, and update to version 2026.2.3 or later. Distinguish between the reachability conditions of the two vulnerabilities, and include credentials and accessible destinations referenced by the monitoring infrastructure in the investigation scope.

16. Summary by Role

• SOC: Correlate service request processing, child processes, files, and external communications, and distinguish between attempts and execution.
• Administrators: Update to the patched version and review non-standard configurations, communication modes, connection sources, and service privileges.
• Users: Report monitoring anomalies or suspicious modifications to administrators.