SolarWinds Observability Self-Hosted 2026.2.3 closes two pre-auth RCEs with different preconditions

By CVSS score, CVE-2026-28324 goes first. By how likely an install is to meet its precondition, it may go second. The report describes that precondition as an insecure, non-standard configuration ^[2], so a default install should not have it. The 8.8 flaw's precondition is given only as a specific communication mode, used from an adjacent network ^[3].

Neither condition is described precisely enough to check. A threat-intelligence summary on dev.to that draws on SolarWinds' advisories says request details and attack paths are unpublished, and so are the services and execution paths involved ^[17][6]. You cannot grep a config file for a condition nobody has written down. Confirming a version string after an upgrade is easy. I think the upgrade is the cheaper proof for nearly every team running this product. One change to 2026.2.3 closes both CVEs ^[1].

The Adjacent rating on CVE-2026-28325 is accurate. The summary is careful to say the flaw cannot be treated as directly executable from anywhere on the internet ^[4]. On a monitoring server I would take less comfort from that than usual. The summary rates both flaws critical because they can affect the privileges and reachable destinations of monitoring infrastructure ^[9]. A monitoring server exists to talk to the hosts it watches. I'd expect many of those hosts to sit on its network segments. Any of them already under an attacker's control would meet the adjacency condition.

For teams that cannot upgrade right away, the summary's interim controls are limits on which sources and paths can talk to the product, and cutting the monitoring service's credentials and destination privileges down to what it needs ^[7][11]. The second control limits damage after a compromise. Code from either flaw would run with the privileges of the affected service ^[10]. No report says user interaction is required ^[16].

The summary describes its own detection guidance as general. It lists abnormal service termination, suspicious child processes, configuration changes and external connections from the monitoring server. It calls these investigative viewpoints, not published indicators for this issue ^[12]. It also suggests checking later use of any credentials and administrator accounts assigned to the monitoring service ^[13]. The summary says its inference about exposed credentials does not mean anyone has seen data theft or lateral movement ^[18].