SolarWinds Observability Self-Hosted < 2026.2.3 Multiple Vulnerabilities

critical Nessus Plugin ID 350168

Language:

Synopsis

An application installed on the remote Windows host is affected by multiple vulnerabilities.

Description

The version of SolarWinds Observability Self-Hosted installed on the remote host is prior to 2026.2.3. It is, therefore, affected by multiple vulnerabilities:

- An insufficient verification of data authenticity vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the host. (CVE-2026-28324)

- A deserialization of untrusted data vulnerability that could allow an unauthenticated attacker on an adjacent network to execute arbitrary code on the host when a specific communication mode is configured. (CVE-2026-28325)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to SolarWinds Observability Self-Hosted version 2026.2.3 or later.

Plugin Details

Severity: Critical

ID: 350168

File Name: solarwinds_observability_self_hosted_2026_2_3.nasl

Version: 1.1

Type: Combined

Agent: windows

Family: CGI abuses

Published: 9/25/2026

Updated: 9/25/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.7

Percentile: 98.94

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-28324

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:solarwinds:orion_platform

Required KB Items: installed_sw/SolarWinds Orion Core

Patch Publication Date: 9/22/2026

Vulnerability Publication Date: 9/22/2026

Reference Information

CVE: CVE-2026-28324, CVE-2026-28325

IAVB: 2026-B-0273

Detections

Analytics