SolarWinds’ Patch Still Needs a Player Check
A monitoring host can reach credentials, infrastructure records and connected systems. Closing a route into it therefore matters beyond the machine itself. The upgrade record also needs to show what happened to its remote components.
The vendor released Observability Self-Hosted 2026.2.3 on 22 September. Both flaws allow code to run remotely, without a login, in affected configurations through 2026.2.2.
CVE-2026-28324, rated critical at 9.8, involves inadequate integrity validation. Its advisory limits exposure to an insecure configuration outside the defaults. The vector permits network access, easy exploitation, no privileges or user action, unchanged scope, and severe confidentiality, integrity and availability consequences. That alone cannot establish exposure in standard installations.
CVE-2026-28325, rated high at 8.8, concerns unsafe deserialisation from an untrusted origin in a particular communications mode. This vector requires adjacent access, but otherwise has the same complexity, privilege, interaction, scope and impact ratings.
At the 20 October source check, neither advisory reported attacks, public exploit code or a general workaround. That describes the checked pages, not proof that exploitation has never occurred. Install the fixed release.
The component check is separate
The notes cover Web Performance Monitor components even without a licence. The principal poller’s built-in player changes from server-led to player-led communications. Remote units using passive communications receive a robust, randomly assigned password, including those with Enable Upgrade disabled; those excluded units retain older software. Already active units need no password after updating.
Record each component’s mode, password handling and installed version. Keep exclusions explicit in the maintenance record: a completed server update cannot establish whether each player changed.
Find the inherited exceptions
Atypical settings may still be yours. Installation history, migrations and inherited exceptions can outlive the people who understood them. Inventory primary, standby, laboratory and acquired environments, then verify both the installed package and the running version after maintenance.
Ask the vendor to identify the triggering settings where its public descriptions are insufficient for your deployment. Limit service and management reachability to necessary systems and administrators. Avoid broadly exposed monitoring control planes.
Preserve evidence from the vulnerable period. Investigate unexpected service execution, child processes, setting changes, new accounts and outbound traffic. Scope credential rotation and downstream investigation to the actual integrations and evidence, not an assumption that patching proves the earlier system was clean.
Our earlier report on a hard-coded secret in another management product is a separate incident. Do not merge its asset inventory or remediation evidence with these two flaws.
Sources and dates
Both linked notices and the release page are dated 22 September 2026, without publication times. Independent coverage followed on 24 September 2026 at 06:40 ET.
