SolarWinds Observability Self-Hosted is vulnerable to an unauthenticated remote code execution flaw caused by insufficient integrity checks. The weakness allows an attacker who can reach the service to execute arbitrary code on the host system, compromising confidentiality, integrity, and availability of the affected environment. The vulnerability is identified as CWE-345, indicating an excessive or inadequate enforcement of access control policies.

Any installation of SolarWinds Observability Self-Hosted that does not use the default or secure configuration is affected. The known solution recommends upgrading to version 2026.2.3 to eliminate the flaw; earlier versions with insecure setups remain vulnerable.

The CVSS score of 9.8 signifies a critical severity level. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, but the high base score and unauthenticated nature of the flaw present a substantial risk. Attackers can exploit the vulnerability remotely over the network without authentication, and once compromised, they can run arbitrary code with the privileges of the Observability Self-Hosted service.