Full Report
SolarWinds security advisory (AV26-950)
Analysis Summary
# Vulnerability: SolarWinds Observability Self-Hosted Remote Code Execution (RCE)
## CVE Details
- **CVE ID:** CVE-2026-28325 (Unauthenticated RCE), CVE-2026-28324 (Authenticated RCE)
- **CVSS Score:** 9.8 (Critical) / 8.8 (High) - *Based on typical SolarWinds RCE severity profiles*
- **CWE:** Not specified in the advisory (Likely CWE-94 or CWE-502 based on RCE nature)
## Affected Systems
- **Products:** SolarWinds Observability Self-Hosted (formerly known as SolarWinds Platform/Orion)
- **Versions:** All versions prior to 2026.2.3
- **Configurations:** Systems exposed to network traffic where the observability management console is accessible.
## Vulnerability Description
The advisory identifies two primary Remote Code Execution (RCE) flaws:
1. **CVE-2026-28325:** A critical vulnerability allowing an **unauthenticated** remote attacker to execute arbitrary code on the underlying host. This typically involves a failure in input validation or insecure deserialization within a publicly accessible endpoint.
2. **CVE-2026-28324:** A vulnerability allowing an **authenticated** user to achieve RCE, potentially leading to privilege escalation from a standard user to system/administrator level.
## Exploitation
- **Status:** Not explicitly stated as exploited in the wild; however, these are high-value targets for APT groups.
- **Complexity:** Low (for CVE-2026-28325)
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full access to system data and monitored infrastructure)
- **Integrity:** High (Ability to modify system configurations and logs)
- **Availability:** High (Ability to disable monitoring or crash the host system)
## Remediation
### Patches
- **SolarWinds Observability Self-Hosted 2026.2.3**: Users are urged to upgrade to this version or later immediately to resolve these flaws.
### Workarounds
- **Network Segmentation:** Ensure the SolarWinds instance is not exposed to the public internet.
- **Access Control:** Restrict access to the management interface to trusted IP addresses/VPNs only.
- **Principle of Least Privilege:** Audit authenticated users to mitigate the risk of CVE-2026-28324.
## Detection
- **Indicators of Compromise:** Monitor for unusual child processes spawning from SolarWinds services (e.g., `cmd.exe` or `powershell.exe` initiated by `SolarWinds.BusinessLayerHost.exe`).
- **Detection methods and tools:** Review web server access logs for unusual POST requests to undocumented endpoints or serialized payloads in headers.
## References
- **SolarWinds Trust Center:** hxxps[://]www[.]solarwinds[.]com/trust-center/security-advisories/cve-2026-28325
- **SolarWinds Trust Center:** hxxps[://]www[.]solarwinds[.]com/trust-center/security-advisories/cve-2026-28324
- **Cyber Centre Alert:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/solarwinds-security-advisory-av26-950