CVE-2026-28330: medium-severity vulnerability in SolarWinds Observability Self-Hosted
SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability
Published
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.6
exploitation probability
—
observed exploitation
nono source reports it
SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected products
SolarWinds · SolarWinds Observability Self-HostedRelated CVEs — SolarWinds Observability Self-Hosted
In the same product, most dangerous first.
CVE-2026-28297MEDIUMSolarWinds Observability Self-Hosted Stored Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2026-28298MEDIUMSolarWinds Observability Self-Hosted Stored Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2025-26397HIGHSolarWinds Observability Self-Hosted Deserialization of Untrusted Data Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2025-26391MEDIUMSolarWinds Observability Self-Hosted XSS VulnerabilityEPSS 0.3%CVE-2025-40545MEDIUMSolarWinds Observability Self-Hosted Open Redirection VulnerabilityEPSS 0.3%CVE-2025-26395HIGHSolarWinds SWOSH DOM-based reflective XSS VulnerabilityEPSS 0.2%
References
https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmhttps://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htmhttps://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28330