September 27, 2026
- SolarWinds patched two unauthenticated RCE flaws in Observability Self-Hosted: CVE-2026-28324 (CVSS 9.8, insufficient integrity check, exploitable on non-default configurations) and CVE-2026-28325 (CVSS 8.8, deserialization of untrusted data in a specific communication mode). All versions up to 2026.2.2 affected, fixed in 2026.2.3; SolarWinds makes no mention of in-the-wild exploitation (SecurityWeek).
· Vulnerabilities & Exploits
in Citrix NetScaler Zero-Days Land Mid-Weekend, No Patch Until Next Week
September 26, 2026
- SolarWinds Access Rights Manager ships a master key. Bishop Fox diffed builds either side of the fix for CVE-2026-28326 and traced it to a client-authentication secret identical on every install, reachable via a fallback path on the gRPC listener at TCP 55555 that requests but does not require a client certificate — landing in a .NET deserialization sink. They built a working chain in lab and got execution as
NT AUTHORITY\SYSTEM, and released a detection tool that fingerprints patch state with two safe requests. SolarWinds scores it 8.8 assuming adjacent-network reach; on a flat network it is 9.8. Fixed in 2026.2.1.7 (Bishop Fox).
· Vulnerability Research & Exploits
in Kiteworks Orders a Global Shutdown on a Zero-Day Warning
September 20, 2026
- SolarWinds patched CVE-2026-28326 (CVSS 8.8) in Access Rights Manager — unauthenticated RCE stemming from a hard-coded static key, affecting all versions through 2026.2, fixed in 2026.2.1. SolarWinds makes no mention of exploitation. The same cycle also shipped fixes for 16 Serv-U flaws covering privilege escalation, RCE and admin-account creation. The Hacker News
· Vulnerabilities & Exploits
in Threat Actors Turn on Each Other as Gemini Walks Into Three Real Networks