Impact

Successful exploitation of CVE-2026-28324 permits an unauthenticated attacker to gain full remote code execution on the target server. This may result in total system compromise, exfiltration of sensitive monitoring data, lateral movement into the internal network, or the deployment of secondary payloads such as ransomware or persistent backdoors. The scope of impact is limited to instances configured in non-default, insecure states.

Recommendation

Prioritized actions for security and IT operations teams:

• Review all SolarWinds Observability Self-Hosted deployments to identify instances using non-default or hardened configurations that may have disabled mandatory integrity checks.
• Audit logs for unexpected process execution or suspicious network activity originating from the SolarWinds application server.
• Apply security patches or configuration updates provided by SolarWinds to remediate the insufficient integrity check vulnerability identified in CVE-2026-28324.