Security46 mSeptember 24, 2026, 17:40

SolarWinds Patches Two Critical RCE Flaws in Observability Self-Hosted

SolarWinds released fixes for two remote code execution vulnerabilities in Observability Self-Hosted: CVE-2026-28324 (CVSS 9.8) and CVE-2026-28325 (CVSS 8.8). Both are exploitable by unauthenticated remote attackers and affect versions up to 2026.2.2, patched in 2026.2.3.

SecurityWeek

Open source

CVE-2026-28324: CVSS 9.8, insufficient integrity check leads to RCE
CVE-2026-28325: CVSS 8.8, deserialization of untrusted data
Versions up to 2026.2.2 affected, fixed in 2026.2.3
Both flaws reported by Kai Huang of Armadin, no known exploitation

#SolarWinds

Revolut customers hit by fresh hack via US stock broker

Security

New RSA attack breaks signatures without factoring the key

Security

Tag confusion in AWS Load Balancer Controller can expose databases to the internet

Security

SolarWinds Patches Two Critical RCE Flaws in Observability Self-Hosted

Revolut customers hit by fresh hack via US stock broker

New RSA attack breaks signatures without factoring the key

Tag confusion in AWS Load Balancer Controller can expose databases to the internet

NIST drafts updated OT security guide; CISA and FBI warn on ICS integrators