SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution…

#Requires -RunAsAdministrator
<#
  Check-CVE-2026-28325.ps1
  Checks SolarWinds Observability Self-Hosted for CVE-2026-28325 exposure.
  Outputs: VULNERABLE / PATCHED / UNKNOWN
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'SilentlyContinue'
$status = 'UNKNOWN'
$reasons = @()

# Step 1: Detect SolarWinds installation and version
$swRegPaths = @(
    'HKLM:\SOFTWARE\SolarWinds\Orion\Core',
    'HKLM:\SOFTWARE\WOW6432Node\SolarWinds\Orion\Core'
)
$installedVersion = $null
foreach ($p in $swRegPaths) {
    $reg = Get-ItemProperty -Path $p -ErrorAction SilentlyContinue
    if ($reg -and $reg.Version) {
        $installedVersion = $reg.Version
        break
    }
}

if (-not $installedVersion) {
    # Fallback: check for SolarWinds services
    $swService = Get-Service -Name 'SolarWinds*' -ErrorAction SilentlyContinue | Select-Object -First 1
    if (-not $swService) {
        Write-Host '[*] SolarWinds Observability Self-Hosted does not appear to be installed.'
        Write-Host 'PATCHED'
        exit 0
    }
    $reasons += 'Could not determine installed version from registry'
}

# Step 2: Check if WPM passive player listener is active on port 17781
$port17781 = Get-NetTCPConnection -LocalPort 17781 -State Listen -ErrorAction SilentlyContinue
$passivePlayerActive = $false
if ($port17781) {
    $passivePlayerActive = $true
    $reasons += 'WPM passive-player listener ACTIVE on port 17781 (vulnerable communication mode)'
} else {
    $reasons += 'Port 17781 not listening (passive WPM player mode not active)'
}

# Step 3: Version comparison
$fixedVersion = '2026.2.3'
if ($installedVersion) {
    $reasons += "Installed version: $installedVersion"
    # Normalize version for comparison (handle YYYY.M.P format)
    try {
        $installed = [version]($installedVersion -replace '^(\d{4})\.(\d+)\.(\d+).*', '$1.$2.$3')
        $fixed = [version]$fixedVersion
        if ($installed -ge $fixed) {
            $status = 'PATCHED'
            $reasons += "Version $installedVersion >= $fixedVersion (patched)"
        } else {
            $status = 'VULNERABLE'
            $reasons += "Version $installedVersion < $fixedVersion (unpatched)"
        }
    } catch {
        $reasons += "Could not parse version string: $installedVersion"
        if ($passivePlayerActive) {
            $status = 'VULNERABLE'
        } else {
            $status = 'UNKNOWN'
        }
    }
} else {
    # No version found but SolarWinds services exist
    if ($passivePlayerActive) {
        $status = 'VULNERABLE'
        $reasons += 'Cannot confirm version but vulnerable communication mode is active'
    } else {
        $status = 'UNKNOWN'
        $reasons += 'Cannot confirm version; passive player mode not active (reduced risk)'
    }
}

# Step 4: Additional context — check if patched behavior is present
if ($status -eq 'PATCHED' -and $passivePlayerActive) {
    $reasons += 'WARNING: Patched version detected but port 17781 still listening — verify WPM player migration completed'
    $status = 'VULNERABLE'
}

Write-Host ''
Write-Host '=== CVE-2026-28325 Check ===' 
Write-Host "Result: $status"
foreach ($r in $reasons) { Write-Host "  - $r" }
Write-Host ''
Write-Host $status

switch ($status) {
    'VULNERABLE' { exit 1 }
    'PATCHED'    { exit 0 }
    default      { exit 2 }
}