Date: September 24, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Enterprise Infrastructure Security / Vulnerability Research / Remote Code Execution
Tags: SolarWinds, Observability Self-Hosted, CVE-2026-28324, CVE-2026-28325, RCE, Insecure Deserialization, Patch Tuesday
Executive Summary
On September 24, 2026, enterprise IT management and monitoring software leader SolarWinds published emergency security advisories addressing two severe vulnerabilities in SolarWinds Observability Self-Hosted (the enterprise evolution of the widely deployed SolarWinds Orion Platform). As reported by SecurityWeek and national cybersecurity agencies including CERT-FR, both vulnerabilities allow remote, unauthenticated attackers to execute arbitrary code with elevated system privileges.
The most severe flaw, tracked as CVE-2026-28324, carries a maximum CVSS v3.1 score of 9.8 (Critical) and stems from an insufficient cryptographic integrity check in the platform's service communication handlers. The second vulnerability, CVE-2026-28325 (CVSS 8.8 / High), resides in an insecure object deserialization routine affecting specific network communication modes.
Both vulnerabilities were discovered and responsibly coordinated by security researcher Kai Huang of Armadin—who also uncovered a hardcoded static encryption key vulnerability (CVE-2026-28326, CVSS 8.8) in SolarWinds Access Rights Manager (ARM) the previous week. Because SolarWinds Observability serves as the central operational cockpit for monitoring switches, hypervisors, cloud VPCs, and server fleets, a compromise of the monitoring server effectively grants adversaries the "keys to the kingdom." SolarWinds has released version 2026.2.3 to remediate both flaws.
Technical Deep-Dive: Architecture and Flaw Mechanics
SolarWinds Observability Self-Hosted operates as an on-premises and hybrid monitoring platform deployed within corporate core networks. To collect real-time performance telemetry, execute remote diagnostic commands, and poll network topology, the platform orchestrates a multi-service daemon architecture:+-----------------------------------------------------------------------------------+
| SOLARWINDS OBSERVABILITY SELF-HOSTED ATTACK VECTORS |
|---|
Unauthenticated Remote Attacker SolarWinds Observability Self-Hosted Host
| |
| [VECTOR 1: CVE-2026-28324 (CVSS 9.8) INTEGRITY BYPASS] |
| 1. Dispatches Crafted Binary IPC Request |
| Targeting Exposed Service Ingress Port |
| [Payload: Forged Management Packet without HMAC] |
|------------------------------------------------------->|
| | 2. Insufficient Integrity Check:
| | Platform accepts packet under
| | non-default / legacy transport!
| | 3. Unauthenticated Remote Code
| | Execution triggered in System context!
| |
| [VECTOR 2: CVE-2026-28325 (CVSS 8.8) DESERIALIZATION] |
| 4. Dispatches Serialized .NET / Binary Formatter Object|
| Over Specific Active Communication Mode |
|------------------------------------------------------->|
| | 5. Insecure Deserialization:
| | Object deserialized without
| | TypeFilterLevel or TypeBinder!
| | 6. Malicious Gadget Chain Fires:
| | Spawns interactive shell as SYSTEM!
|<=======================================================|
| 7. Full Control of Observability Infrastructure: |
| - Extracts SNMP v2/v3 Community Strings |
| - Dumps VMware / Hyper-V Service Account Secrets |
| - Exfiltrates Active Directory Domain Credentials |
1. CVE-2026-28324: Insufficient Integrity Check in Core Service Handlers (CVSS 9.8)
Under standard operation, SolarWinds Observability uses encrypted, authenticated channels to exchange state and tasking data between the central polling engine, collectors, and web consoles.
However, in deployments running customized or non-default communication configurations—such as hybrid proxy modes, legacy collector backward-compatibility, or decoupled agent communication listeners:
* The internal packet dispatching service failed to enforce end-to-end cryptographic signature validation (HMAC) on incoming task requests.
* An unauthenticated network adversary capable of routing TCP traffic to the management service port can dispatch a specially structured binary payload that simulates internal service messages.
* The service processes the unvalidated message, routing it directly to administrative script execution routines and yielding arbitrary code execution with the permissions of the underlying service account (NT AUTHORITY\SYSTEM or privileged domain service accounts).
2. CVE-2026-28325: Insecure Deserialization of Untrusted Data (CVSS 8.8)
CVE-2026-28325 highlights the persistent danger of legacy object serialization protocols within enterprise management suites.
When SolarWinds Observability Self-Hosted is configured in specific communication modes (such as raw telemetry ingestion or distributed agent proxying):
* Incoming binary streams are unpacked using an unsafe object deserialization engine (such as unconstrained .NET BinaryFormatter or custom serialization binders).
* The deserializer fails to enforce strict class whitelisting (SerializationBinder restriction) prior to instantiation.
* By packaging a known .NET gadget chain (utilizing standard Windows system classes like TypeConfuseDelegate or ProcessStartInfo), an unauthenticated remote attacker can trigger code execution during the instantiation phase before any application-level authentication logic is invoked.
3. The Compounding Risk: Armadin Researcher's ARM Disclosures
The disclosure of CVE-2026-28324 and CVE-2026-28325 directly follows Kai Huang’s report of CVE-2026-28326 in SolarWinds Access Rights Manager (ARM) just days earlier. In that flaw, SolarWinds shipped hardcoded cryptographic keys, allowing attackers with network access to decrypt authentication tokens and forge administrative sessions.
Taken together, these vulnerabilities demonstrate that enterprise monitoring and access governance platforms remain prime targets for vulnerability researchers and sophisticated threat actors alike.
Strategic & Operational Impact: The Blast Radius of Monitoring Systems
Monitoring servers represent a Tier-Zero asset in enterprise environments due to their privileged access footprint:
1. Mass Credential Harvesting: Observability platforms inherently store high-privilege credentials required to poll infrastructure—including SNMPv3 authorization keys, Cisco enable passwords, VMware vCenter administrative service tokens, AWS/Azure service principals, and local administrator passwords for thousands of servers.
2. Invisible Lateral Movement: Because network administrators expect constant, high-volume polling traffic between the SolarWinds server and every internal subnet, a compromised monitoring server provides threat actors with an ideal staging ground for lateral movement without triggering network anomaly alerts.
3. Firmware & Agent Supply Chain Pivoting: SolarWinds Observability retains agent push and update capabilities. An attacker with root control over the central server could theoretically distribute trojanized binaries or malicious diagnostic tasks to every enrolled endpoint.
Remediation & Hardening Playbook
All administrators operating SolarWinds Observability Self-Hosted should immediately execute the following defensive actions:
1. Upgrade to Version 2026.2.3
Apply the official vendor maintenance release immediately:
* Navigate to the SolarWinds Customer Portal.
* Download and install SolarWinds Observability Self-Hosted 2026.2.3.
* Verify successful service restart and confirm that all polling engines reflect the updated build version.
2. Restrict Ingress Management Ports (Perimeter & Internal Firewalls)
Never permit direct access to SolarWinds management ports from untrusted networks or the public internet:
* Isolate the Observability server inside a dedicated, restricted Management VLAN.
* Enforce strict stateful firewall access control lists (ACLs) allowing web console access (TCP 443 / 8787) exclusively from authorized administrative jump hosts.
* Disallow inter-VLAN routing to backend communication ports from standard user or workstation subnets.
3. Audit Active Communication Configurations
* Review platform settings to verify that non-default or unencrypted legacy communication modes are disabled.
* Ensure that agent-to-server communications require mutual TLS (mTLS) with valid internal enterprise certificate authorities.
4. Rotate Stored Service Credentials Post-Patching
If SolarWinds servers were exposed to broad internal networks prior to patching:
* Assume potential exposure and systematically rotate all stored credentials within the platform’s Credential Library (SNMP community strings, Windows Domain Service Accounts, vCenter credentials, and cloud API tokens).
* Enable multi-factor authentication (MFA) on all SolarWinds administrative user accounts via SAML/OIDC identity providers.
Conclusion
Enterprise observability software cannot fulfill its mission of safeguarding IT operations if the platform itself becomes an unauthenticated entry point for attackers. Organizations must prioritize patching CVE-2026-28324 and CVE-2026-28325, treat monitoring servers with the same isolation and defense-in-depth principles applied to Active Directory domain controllers, and enforce strict network segmentation.
Find full technical advisories and infrastructure defense guides at Digital Spying.