SolarWinds's critical Observability RCE needs a configuration the vendor calls non-default and non-secure

Both Observability bugs are gated on configuration, and that gate is the first thing a defender has to resolve. CVE-2026-28324 carries a 9.8 and reaches remote code execution on deployments running what SolarWinds describes as non-default and non-secure configurations ^[1]. CVE-2026-28325 is an 8.8 and applies to installations configured to use a specific communication mode ^[2]. The SecurityWeek report describes that mode only in those words ^[13], and SolarWinds points to its security advisories page for the rest ^[14]. So the 9.8 covers a subset of installs. The work ahead of the patch is an inventory: which Observability servers run the non-default configuration, and which use the affected mode.

Everything else holds whatever the configuration. Both can be exploited by remote attackers without authentication, according to SolarWinds ^[3]. Every version up to 2026.2.2 is affected, and 2026.2.3 is the fix ^[4].

Kai Huang of Armadin reported both ^[5]. A week earlier, SolarWinds patched CVE-2026-28326, an 8.8 unauthenticated RCE in Access Rights Manager, also from Huang ^[6]. That bug exists because ARM versions up to 2026.2 contain a hardcoded static key ^[7]. Customers cannot rotate a key compiled into the shipped build, so the vendor's version is the remedy. Counting both rounds, one researcher has produced three unauthenticated RCE findings across two SolarWinds products in about a week ^[10]. The three identifiers are consecutive, and the highest of them, the ARM bug, shipped first ^[11].

Three CVEs from one reporter is research attention on a product line. SolarWinds has not reported exploitation of any of the three in the wild ^[8]. In sequencing terms that puts them behind anything already flagged as under attack, and ahead of very little else, because of where the box sits. Observability Self-Hosted is the on-premises and hybrid monitoring server, offering unified monitoring across environments, configuration management, and control over operational data and security compliance ^[9]. Configuration management is in the vendor's own feature list, so the server is authorized to change the systems it watches. Pre-authentication code execution there starts on a host that already holds that authority.