CVE-2026-28324 & CVE-2026-28325: Unauthenticated RCE in SolarWinds Observability Self-Hosted — Detection and Remediation Guide

SolarWinds has released security fixes for two critical vulnerabilities in SolarWinds Observability Self-Hosted, tracked as CVE-2026-28324 and CVE-2026-28325. Both flaws allow remote code execution without authentication — meaning any attacker who can reach the application's web interface can potentially execute arbitrary code on the underlying host with no credentials, no user interaction, and no prior foothold.

If you run SolarWinds Observability Self-Hosted (the on-premises, Kubernetes-deployed observability platform formerly associated with SolarWinds' Hybrid Cloud Observability line), treat this as a drop-everything patching event. Monitoring and observability platforms are tier-zero assets: they hold credentials for every system they poll, sit in privileged network positions, and — as the 2020 SUNBURST campaign taught the entire industry — they are precisely the kind of infrastructure sophisticated actors target for persistence and lateral movement.

This post breaks down what we know, how to hunt for exploitation, and how to remediate.

Technical Analysis

Affected Product

The key phrase in the vendor disclosure is "without authentication." That single detail drives the entire severity calculus:

• No credential theft required. Internet-facing or broadly internally accessible instances are directly exploitable.
• Exploitation is scriptable. Unauthenticated RCEs are the class of vulnerability that gets folded into scanners and botnets within days of disclosure.
• WAF rules are a speed bump, not a fix. With no published exploit mechanics yet, virtual patching is guesswork. Apply the vendor patch.

Attack Chain (Defender's View)

While full technical details are still emerging, unauthenticated RCE in a web-delivered observability platform typically follows this observable pattern:

1. Reconnaissance — attacker scans for the Observability Self-Hosted web UI (commonly HTTPS on 443 or a custom port exposed via ingress/load balancer).
2. Exploit delivery — a crafted HTTP request reaches a vulnerable endpoint or component within the application stack, triggering code execution in the context of the application container or service account.
3. Post-exploitation — the application process (web server, API service, or worker node) spawns anomalous child processes: shells (/bin/sh, /bin/bash), downloaders (curl, wget), or reverse-shell tooling.
4. Expansion — in a Kubernetes deployment, a compromised pod becomes a launchpad: enumeration of service accounts, secrets mounted in the pod, lateral movement to the cluster API, or egress to attacker C2.

That third step — the application process spawning a shell or downloader — is your highest-fidelity detection opportunity, and it is what the rules below target.

Exploitation Status

At the time of writing, there is no confirmed public proof-of-concept and no confirmed in-the-wild exploitation reported in the disclosure coverage, and the CVEs have not yet appeared in CISA's Known Exploited Vulnerabilities catalog. Do not let that create complacency — unauthenticated RCEs in widely deployed network management platforms have a historically short patch-to-exploit window. Assume scanning for vulnerable instances is already underway and monitor CISA KEV daily for addition of these CVEs, which would trigger federal remediation deadlines under BOD 22-01.

Detection & Response

Because this platform runs on Linux (containers/Kubernetes), endpoint telemetry should come from the underlying hosts, cluster audit logs, and any EDR covering the nodes. The detections below focus on the highest-signal behavior: the web/application stack executing shells, downloaders, or reconnaissance commands.

Sigma Rules

---
title: SolarWinds Observability Process Spawning Shell or Downloader
id: 3f9c2a71-8b4d-4e6a-9c12-7d5e2f8a1b34
status: experimental
description: Detects shells, downloaders, or reconnaissance binaries spawned by web/application server processes on hosts running SolarWinds Observability Self-Hosted. Post-exploitation of CVE-2026-28324/CVE-2026-28325 would cause the application process to execute attacker commands.
references:
  - https://www.securityweek.com/solarwinds-patches-critical-rce-flaws-in-observability-self-hosted/
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/java'
      - '/node'
      - '/nginx'
      - '/apache2'
      - '/httpd'
      - '/python'
      - '/python3'
      - '/dotnet'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/netcat'
      - '/python'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Application health checks or legitimate plugin scripts executed by the observability platform
  - Tune by excluding known SolarWinds job/worker process trees after baselining
level: high
---
title: Outbound Connection from Observability Node to Rare External Destination
id: 8a1d4e62-5c7f-4b39-a2d8-6e9f1c3b5d77
status: experimental
description: Identifies network connections initiated by shells or scripting interpreters on SolarWinds Observability Self-Hosted nodes, consistent with reverse shell or C2 activity following exploitation of CVE-2026-28324/CVE-2026-28325.
references:
  - https://www.securityweek.com/solarwinds-patches-critical-rce-flaws-in-observability-self-hosted/
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/python'
      - '/python3'
      - '/perl'
  filter_local:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
  condition: selection and not filter_local
falsepositives:
  - Administrators running ad-hoc diagnostics from shells on the node
  - Cluster egress proxies may mask true destinations; enrich with proxy/firewall logs
level: high

KQL — Microsoft Sentinel / Defender

This query hunts Syslog (CEF-ingested Linux auditd/execve data) and Defender for Endpoint process telemetry for application-server parents spawning shells or downloaders on your observability hosts. Adjust the host filter to your naming convention.

let ObservabilityHosts = dynamic(["swo-obs", "solarwinds-obs", "observability"]);
let SuspiciousChildren = dynamic(["/bin/sh", "/bin/bash", "/usr/bin/curl", "/usr/bin/wget", "/bin/nc", "/usr/bin/ncat", "/usr/bin/python3", "/usr/bin/perl", "sh", "bash", "curl", "wget", "nc", "python3"]);
union isfuzzy=true
    (Syslog
    | where TimeGenerated > ago(14d)
    | where Computer has_any (ObservabilityHosts)
    | where SyslogMessage has_any ("bash", "wget", "curl", "nc ", "python3")
    | project TimeGenerated, Computer, ProcessName, SyslogMessage, SourceIP),
    (DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where DeviceName has_any (ObservabilityHosts)
    | where FileName in~ ("sh", "bash", "curl", "wget", "nc", "ncat", "python3", "perl")
    | where InitiatingProcessFileName in~ ("java", "node", "nginx", "apache2", "httpd", "python", "dotnet")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, RemoteIP)
| order by TimeGenerated desc

Velociraptor VQL

Use this hunt across your observability nodes to surface live shells or downloaders whose parent process is a web/application runtime — the classic post-RCE fingerprint.

-- SolarWinds Observability Self-Hosted post-exploitation hunt
-- Flags shells/downloaders spawned by web or application runtime processes
LET suspicious_children = ('sh', 'bash', 'dash', 'curl', 'wget', 'nc', 'ncat', 'socat', 'python3', 'perl')
LET suspicious_parents = ('java', 'node', 'nginx', 'apache2', 'httpd', 'python', 'dotnet')

SELECT Pid,
       Ppid,
       Name AS ProcessName,
       Exe AS ProcessPath,
       CommandLine,
       Username,
       CreateTime,
       parent.Name AS ParentName,
       parent.CommandLine AS ParentCommandLine
FROM pslist()
LET parent = SELECT * FROM pslist(pid=Ppid)  -- resolve parent via re-query in hunt context
WHERE (Name IN suspicious_children OR basename(path=Exe) IN suspicious_children)
ORDER BY CreateTime DESC

Note: In production, enrich this with a second pass that joins on Ppid to filter by parent name (Velociraptor deployments vary in how parent resolution is handled — Windows.System.Pslist-style enrichment or a join against a cached pslist table both work). Pair it with netstat() output on the same host to catch established egress sessions from those PIDs.

Remediation

1. Patch Immediately

Apply the fixed release of SolarWinds Observability Self-Hosted per the vendor advisory. Reference the official sources:

• SolarWinds Security Advisories: https://www.solarwinds.com/trust-center/security-advisories
• SolarWinds Trust Center: https://www.solarwinds.com/trust-center
• News coverage: https://www.securityweek.com/solarwinds-patches-critical-rce-flaws-in-observability-self-hosted/

Confirm the exact fixed version against the advisory for CVE-2026-28324 and CVE-2026-28325 before scheduling the upgrade — do not assume your current channel's "latest" build includes the fix until verified.

2. Verify Exposure and Version

Use this script on your observability nodes (or from a management host against them) to inventory deployment state, confirm versions, and check for suspicious web-server child processes pending the patch window:

#!/bin/bash
# SolarWinds Observability Self-Hosted - CVE-2026-28324 / CVE-2026-28325 verification & triage
set -euo pipefail

echo "=== [1] Container/image inventory (identify running SolarWinds Observability images) ==="
if command -v kubectl &>/dev/null; then
  kubectl get pods -A -o wide 2>/dev/null | grep -iE 'solarwinds|observability|swo' || echo "No matching pods found via kubectl"
  echo "--- Images in use: ---"
  kubectl get pods -A -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' 2>/dev/null | sort -u | grep -iE 'solarwinds|swo' || true
fi
if command -v docker &>/dev/null; then
  docker ps --format '{{.Image}} {{.Names}}' 2>/dev/null | grep -iE 'solarwinds|observability|swo' || echo "No matching containers via docker"
fi

echo ""
echo "=== [2] Exposure check: listeners on web ports ==="
ss -tlnp 2>/dev/null | grep -E ':(443|8443|8080|80)\b' || echo "No common web ports listening"

echo ""
echo "=== [3] Post-exploitation triage: shells/downloaders with web-runtime parents ==="
ps -eo pid,ppid,user,comm,args --forest | grep -E '\b(sh|bash|curl|wget|nc|ncat|socat|python3|perl)\b' | grep -v grep || echo "No suspicious child processes found"

echo ""
echo "=== [4] Recent outbound connections from non-standard processes ==="
ss -tnp state established 2>/dev/null | grep -vE ':(443|53|123)\b' | grep -iE 'sh|bash|curl|wget|nc|python|perl' || echo "No suspicious established connections"

echo ""
echo "=== [5] ACTION REQUIRED ==="
echo "Compare discovered image versions against the fixed versions listed at:"
echo "  https://www.solarwinds.com/trust-center/security-advisories"
echo "If versions predate the CVE-2026-28324/CVE-2026-28325 fix, schedule the upgrade immediately."

3. Compensating Controls (Until Patched)

• Restrict network reachability. Place the Observability Self-Hosted UI/API behind a VPN, jump host, or IP allowlist. An unauthenticated RCE is only exploitable by hosts that can reach the port — shrink that set to known administrators and monitored infrastructure.
• Never expose the UI directly to the internet. Audit external DNS, load balancer configs, and cloud security groups for accidental exposure. Run external attack surface scans against your own ranges.
• Kubernetes hardening. If deployed on K8s: enforce readOnlyRootFilesystem where supported, drop all Linux capabilities, disable service account token automounting on observability pods, and apply restrictive NetworkPolicies limiting pod egress to required destinations (SolarWinds update endpoints, internal targets).
• Egress filtering. Block direct outbound internet from observability nodes except to explicitly required vendor endpoints. This breaks reverse shells and payload staging even if exploitation succeeds.
• Increase logging. Ensure container runtime and auditd execve logging is enabled on all nodes, forwarded to your SIEM, and retained — you will want it for retro-hunting.

4. Retro-Hunt

After patching, hunt backwards across at least 30 days of telemetry using the Sigma, KQL, and VQL above. Unauthenticated RCE vulnerabilities are frequently exploited between disclosure and patching — assume breach until your telemetry says otherwise. Specifically review web access logs for anomalous request patterns (unexpected HTTP methods, oversized payloads, requests from single IPs hitting unusual endpoints) in the weeks preceding the patch.

5. Credential Rotation (If Compromise Suspected)

Observability platforms store SNMP communities, WMI/SSH credentials, API tokens, and database strings for monitored assets. If you find evidence of exploitation, rotate every credential the platform holds — treat it with the same urgency as a domain controller compromise.

The Bottom Line

Unauthenticated remote code execution in a self-hosted observability platform is about as bad as vulnerability classes get: the target is privileged, the barrier to exploitation is zero, and the platform's stored credentials make post-compromise lateral movement trivial. The 2020 SolarWinds incident demonstrated exactly why adversaries prize this class of infrastructure. Patch now, restrict exposure, hunt backward, and keep eyes on CISA KEV for escalation of CVE-2026-28324 and CVE-2026-28325.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub