Solarwinds Observability Self Hosted CVE-2026-28298

The CVSS 3.1 score of 5.9 (Medium) reflects the restricted attack profile: attack vector is Adjacent (AV:A, requiring network access from same local network or physically adjacent), access control is Low, privileges required are High (PR:H), and user interaction is required (UI:R). The scope is Unchanged and impact is limited to Confidentiality and Integrity (no Availability impact). CISA's SSVC framework indicates no confirmed exploitation to date, the attack is not automatable (requires manual injection and victim interaction), and technical impact would be total if successful. Together, these signals indicate a legitimate but contained risk: while the stored XSS could expose sensitive user data or manipulate observability dashboards, exploitation demands multiple preconditions (high privileges, adjacent network access, user interaction) that significantly reduce real-world threat likelihood. This is not a high-priority vulnerability despite medium CVSS, as the attack surface is restricted to internal network actors with administrative credentials.

A disgruntled system administrator with high-privilege credentials on the SolarWinds Observability Self-Hosted deployment could inject a malicious JavaScript payload into a dashboard title, alert message, or custom metric field. When other users access those dashboards to view observability data, the stored script executes in their browsers, potentially stealing session tokens, exfiltrating sensitive monitoring data, or redirecting users to a phishing site. The adjacent network requirement and high-privilege prerequisite limit this scenario primarily to insider threat contexts rather than external attacks.