SolarWinds Trust Center advisory CVE-2026-28324 documents an unauthenticated remote code execution vulnerability in Observability Self-Hosted due to insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected. CVSS 3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected: Observability Self-Hosted 2026.2.2 and below.

Fixed: 2026.2.3. Credit: Kai Huang (Armadin). SolarWinds makes no mention of in-the-wild exploitation. Same patch train also addresses sibling CVE-2026-28325 (separate card).

SolarWinds first published the advisory on 22 September 2026. (source: SolarWinds Trust Center)

Correction (31 Oct 2026): removed the SecurityWeek link and credit, which this desk cannot read; every detail comes from SolarWinds' advisory, and the card is now dated by the advisory's first-published date, 22 September 2026, instead of 24 September. (source: SolarWinds Trust Center)