External risk intelligence

SolarWinds Observability Unauthenticated Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-28324

The vulnerability affects SolarWinds Observability Self-Hosted, which is typically deployed within protected internal networks. Because the bulletin specifies that only installations using non-default and non-secure configurations are vulnerable, widespread public internet exposure remains uncommon in standard, secure deployments.

Remote Code Execution

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in SolarWinds Observability Self-Hosted, stemming from inadequate security checks that could allow unauthorized remote code execution. This issue primarily impacts installations that are not configured with default, secure settings, posing a potential risk if exploited. The main concern is confirming whether our specific configurations align with the conditions described, given that such systems are typically managed within internal networks.

Unauthenticated attackers can run code remotely.
Affects non-default, insecure SolarWinds configurations.
Confirm relevance and exposure within our environment.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by sending specially crafted data over the network to a SolarWinds Observability Self-Hosted installation. If the installation is not using its default, secure configuration, this could lead to the execution of arbitrary code with high impact on confidentiality, integrity, and availability.

Unauthenticated network access required.
Insufficient integrity checks are triggered.
Remote code execution leads to high impact.

Live Threat

Current exploitation, exposure, and threat context

In installations of SolarWinds Observability Self-Hosted that are not using default, secure configurations, an unauthenticated remote code execution vulnerability could allow an attacker to execute arbitrary code. This means an attacker could potentially take control of the affected system.

System integrity and data confidentiality.
Unauthenticated network access.
Compromise of affected systems.

Operational Fix

Recommended remediation, mitigation, and detection steps

Addressing this critical vulnerability in SolarWinds Observability Self-Hosted likely falls to application owners and platform teams responsible for maintaining the SolarWinds environment. The first practical step is to identify all instances of the affected technology, confirm whether they are exposed externally or are business-critical, and then locate the specific owner for each instance to initiate a risk-based remediation plan.

Identify application owners and platform teams.
Verify installation security and exposure.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SolarWinds Observability Self-Hosted?

SolarWinds Observability Self-Hosted is a platform that allows organizations to monitor the performance and health of their IT infrastructure, applications, and networks from within their own data centers. Unlike cloud-based SaaS versions, this self-hosted software provides teams with direct control over their monitoring environment and the data it collects, making it a critical tool for maintaining visibility across private network segments.

What does CVE-2026-28324 mean for system security?

This CVE represents a remote code execution vulnerability classified as CWE-345, which refers to insufficient integrity checks. In plain English, the system fails to properly verify the authenticity of incoming data. Because of this, an unauthenticated attacker can send malicious instructions that the application mistakenly processes, potentially allowing them to run unauthorized commands and take control of the affected server.

How is this vulnerability triggered?

An attacker triggers this bug by sending specifically crafted network data to the application. It is important to note that this does not affect all installations; the vulnerability specifically targets environments using non-default, non-secure configurations. If your installation is strictly following the manufacturer's recommended security settings, it does not meet the specific conditions required to trigger this remote code execution.

Is my SolarWinds instance at risk?

According to Halo Surface Signal, this vulnerability is classified as unlikely to impact most users. While the bug allows for remote access, these systems are typically managed within protected internal networks rather than being exposed to the public internet. You should focus your investigation on instances that are not configured with standard security baselines or those that have been modified away from default settings.

What steps should I take if I use this software?

Start by identifying all instances of SolarWinds Observability Self-Hosted within your environment and mapping them to their respective owners. Verify if these installations are using default, secure configurations or if custom, less-secure setups are in place. Once you have identified these systems, collaborate with your platform teams to prioritize them based on their network exposure and critical business functions.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.