CVE-2025-26391: falha de média gravidade em SolarWinds Observability Self-Hosted
SolarWinds Observability Self-Hosted XSS Vulnerability
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.3%
SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL fields. This vulnerability requires authentication from a low-level account.
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Produtos afetados
SolarWinds · SolarWinds Observability Self-HostedCVEs relacionadas — SolarWinds Observability Self-Hosted
No mesmo produto, das mais perigosas para as menos.
CVE-2026-28328HIGHSolarWinds Observability Self-Hosted broken authorization schemaEPSS 0.5%CVE-2026-28297MEDIUMSolarWinds Observability Self-Hosted Stored Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2026-28298MEDIUMSolarWinds Observability Self-Hosted Stored Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2025-26397HIGHSolarWinds Observability Self-Hosted Deserialization of Untrusted Data Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-28329MEDIUMSolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF)EPSS 0.3%CVE-2026-28330MEDIUMSolarWinds Observability Self-Hosted Cross-Site Scripting VulnerabilityEPSS 0.3%