Solarwinds Observability Self Hosted CVE-2026-28297

The CVSS 3.1 score of 6.1 reflects a medium-severity vulnerability with important nuance: the attack vector is Adjacent Network (AV:A, requiring proximity or local network access), privileges required are High (PR:H, meaning only administrators or power users can exploit), and user interaction is not needed (UI:N). The impact is confined to Confidentiality and Integrity (C:H, I:H) with no availability loss (A:N). The SSVC framework indicates no current exploitation (Exploitation: none), the attack is not automatable (Automatable: no), and technical impact is total (affecting the security boundary). The combination of PR:H with AV:A significantly lowers real-world exploitation likelihood compared to unauthenticated remote XSS; however, insider threats from compromised high-privilege accounts or malicious administrators remain credible. The absence of public exploit code and no KEV confirmation from CISA suggests this is not yet a widespread active threat, though the vulnerability warrants timely patching given the trusted nature of observability platform users.

An attacker with high-privilege access (e.g., a system administrator or a compromised admin account) injects a malicious JavaScript payload into a stored data field within SolarWinds Observability Self-Hosted-such as a custom label, configuration parameter, or metric metadata. When another administrator or user views that data through the web interface, the stored script executes in their browser context, potentially stealing session cookies, performing unauthorized actions on behalf of the victim, or harvesting sensitive monitoring data. The attack requires proximity (adjacent network) and high privileges, limiting the attack surface to insider threats or scenarios involving lateral movement from a compromised internal system.