CVE-2026-28330: falha de média gravidade em SolarWinds Observability Self-Hosted
SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability
Publicada em
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.6
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Produtos afetados
SolarWinds · SolarWinds Observability Self-HostedCVEs relacionadas — SolarWinds Observability Self-Hosted
No mesmo produto, das mais perigosas para as menos.
CVE-2026-28297MEDIUMSolarWinds Observability Self-Hosted Stored Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2026-28298MEDIUMSolarWinds Observability Self-Hosted Stored Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2025-26397HIGHSolarWinds Observability Self-Hosted Deserialization of Untrusted Data Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2025-26391MEDIUMSolarWinds Observability Self-Hosted XSS VulnerabilityEPSS 0.3%CVE-2025-40545MEDIUMSolarWinds Observability Self-Hosted Open Redirection VulnerabilityEPSS 0.3%CVE-2025-26395HIGHSolarWinds SWOSH DOM-based reflective XSS VulnerabilityEPSS 0.2%
Referências
https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmhttps://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htmhttps://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28330