CVE-2026-28324 is an unauthenticated remote code execution vulnerability in SolarWinds Observability Self-Hosted caused by insufficient integrity checks (CWE-345). It affects versions from 0 up to but not including 2026.2.3, specifically when the product is configured in a non-default and non-secure manner. The vulnerability allows an attacker to execute arbitrary code remotely without authentication. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

An attacker can remotely execute arbitrary code on affected SolarWinds Observability Self-Hosted installations that are configured insecurely, potentially leading to full system compromise. The vulnerability impacts confidentiality, integrity, and availability of the system. No known exploits are reported in the wild at this time.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, ensure that configurations follow secure defaults and avoid non-default insecure configurations that expose this vulnerability.