CVE-2026-28328

SolarWinds Observability Self-Hosted broken authorization schema

SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Observability Self-hosted

CVE-2026-28329

SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF)

SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Observability Self-hosted

CVE-2026-28330

SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Observability Self-hosted

CVE-2026-28324

SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Observability Self-hosted

CVE-2026-28325

SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Solarwinds

Products

Observability Self-hosted

CVE-2026-28301

SolarWinds Observability Self-Hosted Open Redirect Vulnerability

A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Observability Self-hosted

CVE-2026-28297

SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Observability Self-hosted

CVE-2026-28298

SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Observability Self-hosted

CVE-2025-26391

SolarWinds Observability Self-Hosted XSS Vulnerability

SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL fields. This vulnerability requires authentication from a low-level account.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Observability Self-hosted

CVE-2025-40545

SolarWinds Observability Self-Hosted Open Redirection Vulnerability

SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Observability Self-hosted

CVE-2025-26394

SolarWinds SWOSH Open Redirection Vulnerability

SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Observability Self-hosted

CVE-2025-26395

SolarWinds SWOSH DOM-based reflective XSS Vulnerability

SolarWinds Observability Self-Hosted was susceptible to a cross-site scripting (XSS) vulnerability due to an unsanitized field in the URL. The attack requires authentication using an administrator-level account and user interaction is required.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Observability Self-hosted

CVE-2025-26397

SolarWinds Observability Self-Hosted Deserialization of Untrusted Data Local Privilege Escalation Vulnerability

SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An attacker with low privileges can escalate privileges to run malicious files copied to a permission-protected folder. This vulnerability requires authentication from a low-level account and local access to the host server.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Observability Self-hosted

CVE-2025-26392

SolarWinds Observability Self-Hosted SQL Injection Vulnerability

SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerability requires authentication from a low-privilege account.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Solarwinds

Products

Observability Self-hosted Observability Self Hosted