TECHNOLOGY · AI · CYBERSECURITY · THE SYSTEMS SHAPING BUSINESS
SolarWinds has released Observability Self-Hosted 2026.2.3 to address two vulnerabilities that can allow remote code execution without authentication under affected configurations. The more severe issue, CVE-2026-28324, carries a CVSS score of 9.8 and involves an insufficient integrity check. SolarWinds says it can lead to code execution on deployments using non-default, insecure configurations. A second flaw, CVE-2026-28325, carries a CVSS score of 8.8 and involves deserialization of untrusted data in installations using a specific communication mode.
Both issues affect versions through 2026.2.2 and were reported by researcher Kai Huang of Armadin. SolarWinds has not said the flaws are being exploited in the wild, according to the public advisory summarized by SecurityWeek. That gives customers an opportunity to patch before widespread exploitation is observed, but the product's role inside enterprise environments makes the update a priority.
Two Serious Flaws in a Privileged Monitoring Platform
The details matter because the immediate event is only one part of a larger structural change now moving through enterprise technology and security.
RelatedWhy Monitoring Software Is a High-Value Target
Observability platforms occupy a privileged position. They collect infrastructure telemetry, connect to servers and applications, hold configuration information and are trusted by administrators to describe what is happening across an environment. In many organizations they also have network reach that ordinary applications do not. An attacker who gains control of that layer may be able to move from watching systems to manipulating them.
That risk is not unique to SolarWinds. Monitoring, remote-management, backup and security platforms all concentrate administrative privilege. The same centralization that makes them efficient for defenders can make them valuable to attackers. A compromise can also be harder to recognize because activity originating from a trusted management system may initially look legitimate.
Configuration Details Matter as Much as Severity Scores
The two vulnerabilities are a reminder that CVSS scores do not tell the whole operational story. Exploitability can depend on configuration, network exposure and communication settings. An organization running a vulnerable version behind strict segmentation may face a different practical risk from one that exposes management interfaces broadly or has retained legacy configuration choices over years of upgrades.
Security teams therefore need to pair patch management with configuration management. The first step is determining whether the affected product exists, which version is deployed and whether the vulnerable mode is active. The second is understanding what the product can reach. If the platform has credentials for many systems, broad service-account permissions or access across security zones, reducing that blast radius can matter even after the immediate patch is installed.
SolarWinds Carries Unusual Historical Sensitivity
The company remains closely associated with the 2020 compromise of its Orion software build process, in which malicious code was inserted into signed software updates and distributed to customers. The current Observability Self-Hosted vulnerabilities are a different class of issue: ordinary software defects patched through a security release, not evidence of a new supply-chain compromise. Still, the history means any severe SolarWinds vulnerability will receive heightened scrutiny from customers and regulators.
That scrutiny can be productive if it leads organizations to treat management infrastructure as a separate trust domain. Security teams often focus their strongest controls on databases, identity systems and customer-facing applications, while tools used by administrators accumulate broad permissions. The more enterprises automate operations, the more consequential those management planes become.
Observability systems are attractive targets because they sit close to the systems defenders trust most and often have broad visibility across infrastructure.
What Customers Should Do Now
The immediate action is straightforward: identify affected Observability Self-Hosted deployments and move to version 2026.2.3 in accordance with SolarWinds' guidance. Organizations should also review whether the relevant non-default or communication configurations are in use and restrict network access to management interfaces to the smallest necessary set of administrators and systems.
After patching, teams should look backward. Authentication logs, service-account activity, configuration changes and unusual outbound connections can help determine whether the platform behaved unexpectedly before the fix. Even when a vendor says it has no evidence of exploitation, customers with high-value environments may want their own assurance rather than assuming absence of public evidence means absence of activity.
The broader lesson is that observability software is part of the security perimeter, not merely a tool for looking at it. As infrastructure becomes more automated and agents begin interacting with operational systems, trusted management software will have even more authority. That makes secure defaults, minimal privilege and rapid patching essential properties of the control plane itself.
What Security Teams Should Take From the SolarWinds Fixes
The vulnerabilities also underline why configuration matters in vulnerability scoring. One flaw carried a critical rating but depended on an insecure, non-default setting. That does not make it irrelevant. Large environments accumulate exceptions, legacy settings and migration artifacts, and defenders often do not know which systems have drifted from the hardened baseline. A vulnerability that is conditional in theory can still be broadly exploitable if the condition is common in practice.
Observability platforms deserve special attention because they sit close to privileged operational data. They collect logs, metrics and credentials from many parts of the environment and are often reachable by administrators across network boundaries. Compromising that layer can provide both visibility into the target and a path to additional systems. Security teams should therefore treat monitoring infrastructure as part of the privileged management plane, with restricted access, strong authentication and aggressive patch service levels.
The absence of known exploitation at disclosure is useful but temporary information. Once technical details and patches are public, attackers can reverse engineer the fix and search for unpatched instances. Organizations should use the window before mass scanning accelerates to inventory affected versions, verify configuration prerequisites and upgrade. For high-value management software, a week of delay can matter more than the difference between a theoretical and confirmed exploit on day one.
What to Watch Next
For security leaders, SolarWinds Patches Critical Unauthenticated RCE Flaws in Observability Platform should be treated as a scenario to rehearse rather than a one-off headline. The useful question is what would happen if the same class of activity appeared inside the organization's own environment tomorrow morning. Teams should know which logs they would need, who has authority to isolate systems, how third parties are contacted and which business owners would decide whether operations continue. Practicing those decisions before an incident is often more valuable than adding another alert feed.
The event also reinforces the importance of reducing implicit trust. Long-lived credentials, broad administrative roles and flat network access turn a single successful compromise into a larger problem. Short-lived identities, device-bound authentication, segmentation and just-in-time privilege can make attacks less scalable. These controls are not specific to any one adversary technique, which is exactly why they are useful in a threat landscape that changes faster than annual security programs.
Vendors will face pressure to provide better evidence as well. Customers increasingly expect machine-readable audit trails, documented security boundaries and clear incident-notification commitments. A product that asks for deep access into a company but cannot explain what happened after an anomaly will become harder to approve. Security architecture is moving toward verifiability: not simply trusting a control, but being able to prove when it was invoked and what decision it made.
The broader implication of SolarWinds Patches Critical Unauthenticated RCE Flaws in Observability Platform is that attack speed and organizational complexity are moving in opposite directions. Adversaries can automate discovery and exploitation, while large companies still coordinate response across many teams and suppliers. Closing that gap requires simplifying authority and automating safe defensive actions. The organizations that improve will not necessarily be those with the most tools, but those that can convert a signal into a controlled response with the fewest ambiguous handoffs.
