Three SolarWinds RCE Flaws Expose Monitoring and Access-Control Deployments

SolarWinds has addressed three unauthenticated remote code execution vulnerabilities affecting two enterprise management products. Two flaws are in Observability Self-Hosted, while a third involves Access Rights Manager.

As of September 24, 2026, there is no disclosed evidence that attackers are exploiting these vulnerabilities in the wild. However, successful exploitation could compromise systems responsible for infrastructure monitoring, configuration management, operational data, and access governance.

Two flaws affect Observability Self-Hosted through version 2026.2.2

The most serious issue, CVE-2026-28324, is an insufficient integrity check vulnerability carrying a critical CVSS score of 9.8. It affects deployments using an unsafe, non-default configuration and can lead to remote code execution without authentication.

Its CVSS v3.1 vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

That assessment indicates network-based exploitation with low complexity. An attacker would not need an existing account or any action from a legitimate user. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

The second Observability Self-Hosted issue, CVE-2026-28325, results from deserializing data that has not been trusted or adequately validated. It affects installations configured to use a particular communication mode.

Deserialization vulnerabilities become dangerous when attacker-controlled data is converted into application objects and processed in a way that triggers unintended behavior. In this case, the resulting impact can include unauthenticated code execution.

CVE-2026-28325 has a CVSS score of 8.8 and the following vector:

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The AV:A component describes an adjacent attack position rather than unrestricted network access. SolarWinds nevertheless characterizes the flaw as remotely exploitable without authentication. The precise communication mode and protocol involved have not been disclosed.

Both vulnerabilities affect Observability Self-Hosted versions up to and including 2026.2.2. SolarWinds fixed them in version 2026.2.3.

Exploitability depends on deployment configuration

Neither Observability Self-Hosted vulnerability necessarily exposes every installation through the same path.

CVE-2026-28324 requires a nonstandard configuration that is also considered insecure. CVE-2026-28325 applies when the product uses a specific communication mode. The relevant configuration values have not been identified publicly, so administrators should not assume their systems are unaffected based only on network placement.

The difference between the two CVSS vectors is also operationally significant. CVE-2026-28324 is classified as reachable over a network, whereas CVE-2026-28325 requires adjacent access under the CVSS model. That may limit the second flaw’s exposure, but it does not eliminate the threat inside enterprise, management, or hybrid network segments.

Observability platforms often have broad visibility into monitored environments. A compromised installation could therefore provide an attacker with a valuable position from which to access operational information or interfere with monitoring. The available information does not establish whether either vulnerability enables lateral movement into monitored systems.

Kai Huang of Armadin discovered and reported both Observability Self-Hosted flaws, according to the published SolarWinds vulnerability report.

Access Rights Manager contains a separate static-key vulnerability

SolarWinds also patched an unauthenticated RCE flaw in Access Rights Manager, tracked as CVE-2026-28326.

The vulnerability comes from a hardcoded static key and is classified as CWE-321, or “Use of Hard-coded Cryptographic Key.” Embedding the same cryptographic key in software can undermine controls that depend on the key remaining secret or being unique to each deployment.

CVE-2026-28326 affects ARM versions up to and including 2026.2. Its CVSS v3.1 score is 8.8:

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

As with CVE-2026-28325, the vector identifies an adjacent attack requirement, low attack complexity, no required privileges, and no user interaction. Successful exploitation can produce high confidentiality, integrity, and availability impacts.

The exact ARM release containing the correction has not been identified. Administrators should consult the applicable SolarWinds security advisory before choosing an upgrade target rather than assuming that any version later than 2026.2 contains the fix.

The identity of the researcher who reported the ARM vulnerability is also not known. Kai Huang was explicitly credited for the two Observability Self-Hosted findings, but the ARM disclosure did not make the same attribution.

No active exploitation or KEV deadline has been disclosed

SolarWinds has not reported any of the three vulnerabilities as exploited in real-world attacks. No indicators of compromise, malicious infrastructure, exploit samples, or observed attack procedures have been provided.

The available information also does not establish that CVE-2026-28324, CVE-2026-28325, or CVE-2026-28326 has been added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog. No CISA remediation deadline is available for them.

That distinction matters when prioritizing work. A KEV entry confirms evidence of active exploitation, while a high CVSS score describes technical severity rather than observed attacker use. These flaws currently fall into the latter category based on disclosed information.

Their unauthenticated RCE impact still warrants prompt action, particularly where management services are reachable from user networks, partner connections, remote-access infrastructure, or other less trusted segments.

Administrators should patch and review management-network exposure

Organizations running Observability Self-Hosted should upgrade all installations at version 2026.2.2 or earlier to 2026.2.3. They should also identify whether deployments use non-default security settings or the communication mode associated with CVE-2026-28325.

For Access Rights Manager, every release through 2026.2 should be treated as affected. Because the corrected version is not known from the available information, teams must verify the appropriate remediation directly against SolarWinds’ ARM advisory.

Until updates are completed, administrators can reduce exposure by limiting access to product interfaces and communication channels from untrusted networks. This is a compensating control, not a vendor-provided workaround.

Security teams should also review affected servers for unusual process creation, unexpected outbound connections, unauthorized configuration changes, and newly created accounts. These are general investigative areas rather than vulnerability-specific indicators.

There are no published indicators that can conclusively identify exploitation. Consequently, version inventory, configuration review, network exposure analysis, and prompt patching remain the principal defensive measures.