What is the CVSS score of CVE-2025-26392?

CVE-2025-26392 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2025-26392?

Yes, a patch is available for CVE-2025-26392. Update the affected software to the latest version immediately.

SolarWinds Observability CVE-2025-26392

MEDIUM

SQL Injection (CWE-89)

2025-10-21 psirt@solarwinds.com

Information Disclosure SQLi Observability Self Hosted Solarwinds

4.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

4.3 MEDIUM

Web-console SQLi is normally network-reachable (AV:N vs vendor AV:A) and needs a low-priv login (PR:L); description cites only data display, so C:L with I:N/A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Metadata Corrected

Oct 08, 2026 - 23:40 vuln.today

tag: Solarwinds added

Analysis Generated

Oct 08, 2026 - 22:49 vuln.today

DescriptionNVD

SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerability requires authentication from a low-privilege account.

AnalysisAI

Authenticated SQL injection in SolarWinds Observability Self-Hosted allows an attacker holding a low-privilege account to read data beyond that account's authorization by supplying crafted input to a SQL-injectable field in the application. The vendor rates this CVSS 4.6 (AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), reflecting limited confidentiality and integrity impact rather than full database compromise or service disruption; our independent assessment keeps the same low-privilege authentication prerequisite and limited confidentiality impact, but raises the attack vector to network-reachable (AV:N) and treats integrity impact as none, since the practical outcome is information disclosure. Vendor patches are available, and no public exploit code has been identified at time of analysis - the risk profile is a low-to-moderate priority requiring an already-obtained credential rather than an urgent, remotely exploitable flaw.

Technical ContextAI

The issue is a classic CWE-89 SQL injection in the database query layer of SolarWinds Observability Self-Hosted (the product line associated with the HCO/Hybrid Cloud Observability release notes). User-supplied input reaching a query is not safely parameterized, so a crafted value can alter the query's logic and return rows the session is not entitled to see. Exploitation is not pre-authentication: the CVSS vector carries PR:L, meaning the attacker must first hold a valid low-privilege ('low-level') account, and must then supply the malicious input to the injectable field. The vendor vector also specifies AV:A, implying the attacker is positioned on an adjacent or management network segment rather than the open internet, while our independent assessment uses AV:N because the service is typically network-accessible - either way, the impact ceiling (C:L, no availability impact, and at most I:L per the vendor) is data disclosure, not full database control or code execution. The CPE entry cpe:2.3:a:solarwinds:observability_self-hosted:*:*:*:*:*:*:*:* uses a wildcard version, indicating the advisory covers the product family collectively rather than a single build.

RemediationAI

Apply the vendor patch: SolarWinds has published a fix for CVE-2025-26392, with details in the SolarWinds trust-center advisory (https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26392) and the associated HCO 2025-4 release notes (https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2025-4_release_notes.htm); upgrade to the release documented there rather than relying on any interim workaround. If immediate upgrade is not feasible, prioritize compensating controls that address the authenticated, low-privilege prerequisite and the adjacent-network exposure implied by the vendor's AV:A vector: restrict reachability of the Observability Self-Hosted web/API interfaces to trusted management subnets via firewall or ACL rules (trade-off: remote administration from other segments must route through a jump host), and place the platform behind an authenticated reverse proxy with strong MFA (trade-off: added latency and a proxy to maintain). Because the attacker needs a valid low-privilege account, audit and trim account inventories, rotate credentials for low-privilege and service accounts, and remove stale or shared logins; enable and review database query logging for anomalous or unusually broad SELECT activity from low-privilege sessions (trade-off: log volume and storage growth). None of these controls fully close the injection point - they only reduce reachability and detect abuse - so scheduling the vendor upgrade remains the primary remediation.