Unauthenticated RCE via Deserialization in SolarWinds Observability Self-Hosted
CVE-2026-28325 Published on September 22, 2026
SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode.
Vulnerability Analysis
Attack Vector:
ADJACENT_NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
Weakness Type
What is a Marshaling, Unmarshaling Vulnerability?
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVE-2026-28325 has been classified to as a Marshaling, Unmarshaling vulnerability or weakness.
Affected Versions
SolarWinds Observability Self-Hosted:- Before 2026.2.3 is affected.