CVE-2026-28330
SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability
- State
- Published
- Severity
- 4.6 Medium
- Published
- Oct 20, 2026
- Updated
- Oct 23, 2026
- Reserved
- Feb 26, 2026
Description
SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.6 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | SolarWinds |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
SolarWinds Observability Self-HostedSolarWinds |
|
References
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htmrelease-notes
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28330vendor-advisory
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.