SolarWinds Observability Self-Hosted: Broken authorization
Summary
SolarWinds Observability Self-Hosted contains a broken authorization schema (CWE-863). A low-privileged user with a valid account can access and modify information beyond their assigned permissions. The attack is network-based and needs no user interaction. CVSS 3.1 base score is 8.8 (High).
Affected
- Observability Self-Hosted 2026.2.3 and all previous versions
- Versions 2026.3.x: not stated by the vendor in the sources; treat as affected until SolarWinds clarifies
Fixed in
- Observability Self-Hosted 2026.4 (vendor recommendation)
- Release notes state that 2026.4 was removed from the release portal due to update issues; install 2026.4.1 instead
Workaround
No workaround documented in the sources reviewed. Upgrading is the remedy.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total
- No evidence of exploitation in the wild found; not listed in KEV
- EPSS below 1 percent (very low)
- No public proof of concept found in the research; absence of evidence is not proof
Our recommendation
- Inventory all Observability Self-Hosted instances and their versions, including 2026.3.x builds
- Upgrade instances at or below 2026.2.3 to 2026.4.1 and verify the version afterwards
- Review low-privileged accounts and remove unneeded ones
- Check whether the management interface is reachable from the internet and restrict access to trusted hosts
- Monitor the NVD entry and the vendor advisory for updates
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- SolarWinds security advisory CVE-2026-28328 www.solarwinds.com
- SolarWinds Observability Self-Hosted 2026.4 release notes documentation.solarwinds.com
- SolarWinds Secure Configuration guide documentation.solarwinds.com
- OpenCVE entry CVE-2026-28328 app.opencve.io
- SecurityWeek: SolarWinds patches critical RCE flaws in Observability Self-Hosted www.securityweek.com
- Strix CVE entry CVE-2026-28328 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:34.
Original description (NVD)
SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.
NVD references (3)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.