SolarWinds Observability Self-Hosted Authorization Flaw Allows Data Modification

SolarWinds Observability Self-Hosted versions 2026.2.3 and all earlier releases contain a broken authorization schema. This flaw permits low-privileged users to access and modify information that falls outside their assigned permissions. The National Vulnerability Database assigns CVE-2026-28328 to this issue and rates it as high severity with a CVSS score of 8.8. According to the NVD record, the weakness aligns with CWE-863. The source material does not confirm the availability of a patch or fix.

How it unfolded

• The National Vulnerability Database published the record for CVE-2026-28328.
• The entry identifies SolarWinds Observability Self-Hosted 2026.2.3 and all previous versions as affected.
• The description notes the flaw allows unauthorized data access and modification by low-privileged users.

Who is affected

Organizations running SolarWinds Observability Self-Hosted are impacted by this authorization failure. The vulnerability applies to version 2026.2.3 and every release preceding it. Any deployment using these versions is susceptible to the described access issues. Low-privileged users can bypass intended access controls. They can view and alter data they should not reach. This breaks the principle of least privilege. The NVD classifies the impact as high severity. The source material does not specify limitations on configurations.

Our take on the response

The absence of a confirmed patch leaves managed service providers in a difficult position. They must manage exposure without a vendor-supplied remedy. The high CVSS score indicates significant potential damage. Broken authorization flaws often lead to data integrity issues. Teams should monitor for unauthorized changes closely. The lack of a fix suggests that compensating controls are the only immediate option. Organizations must rely on strict access reviews. They should limit the number of low-privileged accounts. This reduces the attack surface for this specific flaw.

Who needs to act first

Teams should prioritize systems with internet-facing access or those containing sensitive data. Audit user permissions immediately to remove unnecessary low-privileged accounts. Review access logs for signs of unauthorized data modification. Implement strict network segmentation to limit lateral movement. If possible, restrict external access to the Observability platform. Monitor for unusual activity from accounts with limited rights. Ensure that change management processes are robust. Verify that all user roles adhere to the principle of least privilege. Document any anomalies for further investigation.

What to do and how to stay safe: SolarWinds

• Review user permissions and remove unnecessary low-privileged accounts.
• Monitor access logs for unauthorized data modification attempts.
• Implement network segmentation to limit lateral movement.
• Restrict external access to the Observability platform.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of SolarWinds Observability Self-Hosted are affected?

Version 2026.2.3 and all previous versions are affected by CVE-2026-28328.

Is there a patch available for this vulnerability?

The source material does not confirm the availability of a patch or fix.

What is the severity rating for CVE-2026-28328?

The National Vulnerability Database rates it as high severity with a CVSS score of 8.8.