EUVD-2026-84678
GHSA-r476-9mp7-phxc
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Agree with vendor: adjacent-network reachable service (AV:A), no auth/interaction (PR:N/UI:N), deserialization yields full C/I/A code execution; the config gate is a deployment prerequisite, not attacker privilege, so PR stays N.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
Lifecycle Timeline
3DescriptionCVE.org
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode.
AnalysisAI
Unauthenticated remote code execution in SolarWinds Observability Self-Hosted (CVSS 8.8) allows attackers on an adjacent network to execute arbitrary code via deserialization of untrusted data, but only when the deployment is configured to use a specific non-default communication mode. Default-configured instances are not exploitable, and the adjacent-network attack vector (AV:A) further narrows the exposed population. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the SolarWinds Observability Self-Hosted deployment to be configured to use a specific (non-default) communication mode named in the advisory; the vulnerable deserialization endpoint only exists in that mode, so default-configured instances are not exploitable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue but with an important gating caveat. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to the version referenced in the SolarWinds release notes (HCO 2026.2.3) as detailed in the advisory (https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28325). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SolarWinds Observability Self-Hosted instances and determine which ones are running the non-default communication mode referenced in the vendor advisory; for any confirmed instance, isolate it on a dedicated, tightly segmented network segment so that only explicitly required hosts can reach it, and confirm no unnecessary adjacent-network paths exist. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Observability Self Hosted
View allUnauthenticated remote code execution affects SolarWinds Observability Self-Hosted installations that are running in a n
Stored/reflected cross-site scripting (XSS) vulnerability in SolarWinds Observability Self-Hosted caused by insufficient
SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sani
Open redirect in SolarWinds Observability Self-Hosted enables an authenticated low-privilege attacker on an adjacent net
Authenticated SQL injection in SolarWinds Observability Self-Hosted allows an attacker holding a low-privilege account t
SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. Rated medium severity (CVSS 4.
SolarWinds Observability Self-Hosted XSS Vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is low atta
Same weakness CWE-502 – Deserialization of Untrusted Data
View allShare
External POC / Exploit Code
Leaving vuln.today