CVE-2026-28330: fallo de gravedad media en SolarWinds Observability Self-Hosted
SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability
Publicada el
10Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.6
probabilidad de explotación
—
explotación observada
noninguna fuente lo reporta
SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Productos afectados
SolarWinds · SolarWinds Observability Self-HostedCVEs relacionadas — SolarWinds Observability Self-Hosted
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-28297MEDIUMSolarWinds Observability Self-Hosted Stored Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2026-28298MEDIUMSolarWinds Observability Self-Hosted Stored Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2025-26397HIGHSolarWinds Observability Self-Hosted Deserialization of Untrusted Data Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2025-26391MEDIUMSolarWinds Observability Self-Hosted XSS VulnerabilityEPSS 0.3%CVE-2025-40545MEDIUMSolarWinds Observability Self-Hosted Open Redirection VulnerabilityEPSS 0.3%CVE-2025-26395HIGHSolarWinds SWOSH DOM-based reflective XSS VulnerabilityEPSS 0.2%
Referencias
https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmhttps://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htmhttps://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28330