SolarWinds has pushed out Observability Self-Hosted version 2026.2.3 after discovering two critical vulnerabilities—CVE-2026-28324 and CVE-2026-28325—that allow unauthenticated remote code execution on certain observability servers. The flaws are especially relevant for setups using Web Performance Monitor (WPM) components or communication modes outside of the default configuration. The update arrived on September 22, 2026.
The more severe issue, CVE-2026-28324, carries a CVSS score of 9.8 out of 10. It stems from weak integrity checks when non-default settings are in play. The second bug, CVE-2026-28325, is rated 8.8 and traces back to unsafe deserialization of untrusted data under a specific communication mode. Both vulnerabilities can be exploited without any authentication—no login needed.
What has changed in 2026.2.3
SolarWinds’ fix doesn’t introduce new features. Instead, it focuses squarely on security and reliability. One significant behavioral adjustment targets remote passive WPM players: those installed by default on a system’s main polling engine will now switch to a player-initiated communication model. Also, these passive players are now automatically assigned strong, randomly generated passwords during upgrade—though devices with the “Enable Upgrade” option disabled must be updated manually. Active WPM players using player-initiated communication don’t require a password post-upgrade.
Action Items for Admins
Organizations running SolarWinds Observability Self-Hosted should immediately verify whether any of their instances employ non-default configuration settings or particular communication modes vulnerable to these exploits. Admins should also identify main polling engines, remote WPM players, and ensure those with passive, remote status have solid credentials. If automatic updates are disabled for certain components, those must be patched manually.
Older deployments are especially at risk: versions 2024.2 and earlier no longer receive support or security fixes. Additionally, it’s wise to limit server exposure, restrict management access to trusted networks, and monitor application logs—including Windows event and SolarWinds logs—for odd activities involving polling engines and WPM players.
These flaws were responsibly reported by Kai Huang of Armadin. The urgency is high: with two RCE vulnerabilities—one critical—with no authentication needed, exploitation could happen quickly once attackers identify exposed servers.
SolarWinds Observability is a self-hosted monitoring solution—used to visualize system performance and monitor applications, services, networks, etc. Remote code execution (RCE) bugs like these are among the most severe, since they allow attackers to run arbitrary code on targets without prior access. That makes this update one of the most crucial patches in recent weeks.
Analysis:The rapid discovery and disclosure of these vulnerabilities highlights a recurring issue: non-default configurations often harbor unseen risks, particularly in observability tools that communicate across networks. For firms relying on Self-Hosted Observability, this is a reminder that hardened defaults matter—and that visibility into deployment specifics (communication modes, player types) is essential. Going forward, expect vendors to tighten default security, simplify configuration complexity, and place stronger guards around deserialization routines. Stakeholders should watch for similar flaws in competing monitoring platforms and ensure patch cycles remain swift and thorough.
