This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] SolarWinds fixes 3 vulnerabilities
SolarWinds fixes 3 vulnerabilities in Observability Self-Hosted and Access Rights Manager [1][2][3]. Individual products and their fixed versions: SolarWinds Access Rights Manager – 2026.2.1 [1] SolarWinds Observability Self-Hosted – 2026.2.3 [2][3]
An unauthenticated attacker from an adjacent network can execute arbitrary code due to the use of a hard-coded static key in SolarWinds Access Rights Manager [1].
The vulnerability is present in product:
- SolarWinds Access Rights Manager; <2026.2.1
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-28326 at cve.org, NVD
- CWE-321: Use of Hard-coded Cryptographic Key at cwe.mitre.org
The vulnerability was publicly disclosed 17. 9. 2026.
An unauthenticated remote attacker can execute arbitrary code due to insufficient integrity verification in SolarWinds Observability Self-Hosted [2].
The vulnerability is present in product:
- SolarWinds Observability Self-Hosted; <=2026.2.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-28324 at cve.org, NVD
- CWE-345: Insufficient Verification of Data Authenticity at cwe.mitre.org
The vulnerability was publicly disclosed 22. 9. 2026.
An unauthenticated attacker from an adjacent network can execute arbitrary code due to deserialization of untrusted data in SolarWinds Observability Self-Hosted [3].
The vulnerability is present in product:
- SolarWinds Observability Self-Hosted; <2026.2.3
CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-28325 at cve.org, NVD
- CWE-502: Deserialization of Untrusted Data at cwe.mitre.org
The vulnerability was publicly disclosed 22. 9. 2026.
Links
By CESNET, z.s.p.o. Henrieta Paločková on 23. 9. 2026.