SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution…

CVE-2026-28324 is an unauthenticated remote code execution flaw in SolarWinds Observability Self-Hosted (formerly Hybrid Cloud Observability) versions prior to 2026.2.3. The root cause is CWE-345 — insufficient verification of data authenticity — in the Web Performance Monitor (WPM) player communication channel. When the WPM player is configured in passive mode (server-initiated connections on TCP port 17781, a *non-default* and *non-secure* setting), the platform fails to validate the integrity of inbound data, allowing an unauthenticated, network-adjacent attacker to deliver a crafted request that results in arbitrary code execution on the underlying host. The sibling flaw CVE-2026-28325 (CVSS 8.8) targets deserialization in the same communication path. Both were reported by Kai Huang of Armadin and patched on 2026-09-22.

SolarWinds rated this 9.8 CRITICAL, and the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a zero-click, no-auth, full-impact chain — which is *technically accurate for the vulnerable configuration*. But the advisory itself qualifies the score: exploitation requires a non-default, non-secure configuration (passive WPM player mode). Default installations — and the now-recommended active-player mode — are not vulnerable. That qualifier, combined with the fact that SolarWinds Observability servers almost never expose WPM ports to the internet, means the real-world attack surface is meaningfully narrower than a blanket 9.8 implies. The vendor severity oversells the risk for most environments while remaining directionally correct for the subset running passive WPM players on reachable network segments.

1. Immediately audit WPM player communication mode across all Observability installations — Query the SolarWinds configuration database or Web Console (Settings > All Settings > WPM Settings > Player Communication) to identify any players running in passive mode on port 17781. Any passive-mode player with non-secure (non-TLS) communication is the vulnerable configuration. This is your triage gate — if no passive players exist, the CVE does not apply. Complete within 30 days per noisgate mitigation SLA for HIGH.
2. Switch passive WPM players to active mode immediately on confirmed-vulnerable hosts — In the SolarWinds Web Console, navigate to WPM Player settings and switch all passive players to active mode (player-initiated on port 17782 over HTTPS). This eliminates the attack surface without requiring the full platform upgrade. Deploy within 30 days per noisgate mitigation SLA.
3. Block TCP/17781 inbound at host firewall and network segmentation layer — If you cannot immediately switch to active mode, create firewall rules restricting TCP/17781 to only the known SolarWinds polling engine IPs. Deny all other sources. This limits the attacker's ability to reach the vulnerable listener even from an internal pivot point.
4. Upgrade to SolarWinds Observability Self-Hosted 2026.2.3 — The definitive fix. Version 2026.2.3 auto-migrates passive players to active mode and generates strong passwords for remote passive players. Apply within 180 days per noisgate remediation SLA for HIGH severity. Test in a non-production SolarWinds environment first — the migration changes player communication behavior.
5. Rotate all credentials stored in SolarWinds Observability — If you confirmed passive WPM mode was active, treat stored monitoring credentials (SNMP community strings, WMI accounts, SSH keys, SQL connection strings) as potentially exposed. Rotate them after patching to close the post-compromise pivot path.
6. Deploy EDR monitoring rules for SolarWinds service processes — Create detection rules for unexpected child processes under SolarWinds.BusinessLayerHost.exe, SolarWinds.Collector.Service.exe, or equivalent Linux daemons. Alert on cmd.exe, powershell.exe, bash, or python spawning from these parents.

Run this script on each SolarWinds Observability Self-Hosted server (polling engines and additional web servers) as a local administrator. Execute: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-28324.ps1. The script checks the installed product version and queries the WPM player communication mode from the registry and configuration database.

#Requires -RunAsAdministrator
<#
  Check-CVE-2026-28324.ps1
  Checks whether this SolarWinds Observability Self-Hosted server is
  vulnerable to CVE-2026-28324 (unauthenticated RCE via passive WPM player).
  Output: VULNERABLE / PATCHED / UNKNOWN
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'
$result = 'UNKNOWN'
$exitCode = 2

try {
    # Step 1: Check installed SolarWinds Observability version
    $swRegPaths = @(
        'HKLM:\SOFTWARE\SolarWinds\Orion',
        'HKLM:\SOFTWARE\WOW6432Node\SolarWinds\Orion'
    )
    $installedVersion = $null
    foreach ($p in $swRegPaths) {
        if (Test-Path $p) {
            $v = (Get-ItemProperty -Path $p -Name 'Version' -ErrorAction SilentlyContinue).Version
            if ($v) { $installedVersion = $v; break }
        }
    }

    if (-not $installedVersion) {
        Write-Host '[!] SolarWinds Observability Self-Hosted not detected on this host.'
        Write-Host 'UNKNOWN'
        exit 2
    }

    Write-Host "[*] Detected SolarWinds version: $installedVersion"

    # Step 2: Parse version and compare against 2026.2.3
    $patchedVersion = [Version]'2026.2.3'
    try {
        $currentVersion = [Version]$installedVersion
    } catch {
        Write-Host "[!] Could not parse version string: $installedVersion"
        Write-Host 'UNKNOWN'
        exit 2
    }

    if ($currentVersion -ge $patchedVersion) {
        Write-Host '[+] Version is >= 2026.2.3 (patched).'
        $result = 'PATCHED'
        $exitCode = 0
    } else {
        Write-Host '[-] Version is < 2026.2.3 (potentially vulnerable).'

        # Step 3: Check if WPM module is installed
        $wpmPath = Join-Path $env:ProgramFiles 'SolarWinds\Orion\WPM'
        $wpmInstalled = Test-Path $wpmPath

        if (-not $wpmInstalled) {
            Write-Host '[+] WPM module not installed - CVE-2026-28324 does not apply.'
            $result = 'PATCHED'
            $exitCode = 0
        } else {
            Write-Host '[*] WPM module detected. Checking player communication mode...'

            # Step 4: Check for passive mode listener on port 17781
            $listener = Get-NetTCPConnection -LocalPort 17781 -State Listen -ErrorAction SilentlyContinue
            if ($listener) {
                Write-Host '[-] PASSIVE MODE DETECTED: TCP/17781 is listening.'
                Write-Host '[-] This host is running the non-default vulnerable configuration.'
                $result = 'VULNERABLE'
                $exitCode = 1
            } else {
                Write-Host '[*] TCP/17781 not listening (passive mode not active).'
                Write-Host '[*] Checking TCP/17782 for active mode...'
                $activeListener = Get-NetTCPConnection -LocalPort 17782 -State Listen -ErrorAction SilentlyContinue
                if ($activeListener) {
                    Write-Host '[+] Active mode (TCP/17782) detected - not vulnerable to this CVE.'
                    $result = 'PATCHED'
                    $exitCode = 0
                } else {
                    Write-Host '[?] Neither passive (17781) nor active (17782) port detected.'
                    Write-Host '[?] WPM may be installed but not configured. Verify manually.'
                    $result = 'UNKNOWN'
                    $exitCode = 2
                }
            }
        }
    }
} catch {
    Write-Host "[!] Error during check: $_"
    $result = 'UNKNOWN'
    $exitCode = 2
}

Write-Host ""
Write-Host "=== RESULT: $result ==="
exit $exitCode

1. SolarWinds Trust Center — CVE-2026-28324 Advisory
2. SecurityOnline — SolarWinds Observability Vulnerabilities Enable RCE
3. Mallory AI — SolarWinds Observability Self-Hosted Patches Critical Unauth RCE
4. OffSeq Threat Radar — CVE-2026-28324 Live Intelligence
5. Strix AI — CVE-2026-28324 Detail
6. SolarWinds Documentation — WPM Player Communication Settings
7. Canadian Centre for Cyber Security — SolarWinds Advisory AV26-549
8. CVEDetails — SolarWinds Vulnerability List