In plain words
Think of it like a door with a weak lock. If someone finds out how to pick that lock, they can get in without a key. Here, the lock is like a security system in a product called SolarWinds Observability Self-Hosted¹. The weak lock is a couple of serious security flaws that can be exploited without needing a password or special access.
What's broken
The specific bugs are tracked as CVE-2026-28324² and CVE-2026-28325³. These are Remote Code Execution (RCE)⁴ flaws, which means an attacker can run their own code on the affected system without being authorized to do so. This can happen without the attacker needing to log in or have any special permissions, which makes these flaws especially dangerous.
How it actually works
Here's how it works: an attacker finds the vulnerable system and sends it some specially crafted data. This data is like a special key that fits into the weak lock. Once the lock is opened, the attacker can run their own code on the system. This is possible because of the RCE flaws, which allow the attacker to execute commands on the system without authentication⁵. The system thinks the commands are coming from a trusted source, so it does what it's told.
Proof of concept
There is a proof of concept (PoC)⁶, which is like a demonstration that shows these flaws are real and can be exploited. This PoC proves that the flaws are not just theoretical but can actually be used by an attacker. The existence of a public PoC increases the urgency to patch these flaws because it shows that attackers can use them too.
Is it real
It's not clear from the source if these flaws are being actively exploited in the wild. However, the fact that they can be exploited without authentication makes them particularly risky. A limiting factor could be that the vulnerable feature might be turned off by default in some configurations, but this is not specified.
What to do
To fix these flaws, users should apply the patches provided by SolarWinds. This is like replacing the weak lock with a stronger one, so the system is secure again. Users should update their SolarWinds Observability Self-Hosted products to the latest version to ensure they have the fixes for these critical RCE flaws.
Terms
- ¹ SolarWinds Observability Self-Hosted
- , A product that helps monitor and understand the performance of computer systems and applications.
- ² CVE
- , A unique identifier for a security vulnerability.
- ³ RCE
- , A type of security flaw that allows an attacker to run their own code on a system.
- ⁴ without authentication
- , When an attacker can run code on a system without needing to log in or have special permissions.