Vulnerability in SolarWinds Observability Self-Hosted

[ Description ]Official description

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode.

[ Fixes ]Fixes and patches

• Security bulletin: SolarWinds cve-2026-28324Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28324, cited by CERT-FR CERTFR-2026-AVI-1215
• Security bulletin: SolarWinds cve-2026-28325Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28325, cited by CERT-FR CERTFR-2026-AVI-1215

[ Advisories ]Government CERT advisories

• NCSC-NL23 Sep 2026NCSC-2026-0388

  Vulnerabilities fixed in SolarWinds Observability Self-Hosted Translated from Dutch

  Probability/damage M/HCVE-2026-28325CVE-2026-28324
• CERT-FR23 Sep 2026CERTFR-2026-AVI-1215

  Multiple vulnerabilities in SolarWinds Observability Self-Hosted Translated from French

  Multiple vulnerabilities have been discovered in SolarWinds Observability Self-Hosted. They allow an attacker to cause remote arbitrary code execution.

  CVE-2026-28325CVE-2026-28324

[ References ]References

• documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_…release-notes
• www.solarwinds.com/trust-center/security-advisories/CVE-2026-28325vendor-advisory
• documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-config…x_secure-configuration-guide