What is the CVSS score of CVE-2026-28322?

CVE-2026-28322 has a CVSS 3.1 base score of 5.6 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Database Performance Analyzer CVE-2026-28322

EUVD-2026-40457 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 SolarWinds

GHSA-5j72-hhf9-wpj4

XSS Database Performance Analyzer Solarwinds

5.6

CVSS 3.1 · Vendor: SolarWinds

Severity by source

Vendor (SolarWinds) PRIMARY

5.6 MEDIUM

AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

5.6 MEDIUM

Adjacent vector reflects internal-only DPA deployment; PR:H and UI:R match admin-injection and victim-browse requirements; no availability impact for XSS.

3.1 AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

4.0 AV:A/AC:H/AT:N/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (SolarWinds).

CVSS VectorVendor: SolarWinds

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 23:41 vuln.today

DescriptionCVE.org

SolarWinds Database Performance Analyzer was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.

AnalysisAI

Stored cross-site scripting in SolarWinds Database Performance Analyzer enables a highly privileged, adjacent-network attacker to persist malicious scripts in the application that execute within other users' browsers upon page load. The CVSS vector (AV:A/AC:H/PR:H/UI:R) imposes substantial constraints - adjacency, high complexity, admin-level credentials, and victim interaction are all required - limiting realistic risk to insider-threat or post-compromise scenarios. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Technical ContextAI

SolarWinds Database Performance Analyzer (DPA) is an enterprise database monitoring and performance optimization platform with a web-based management interface. The vulnerability is catalogued under CWE-20 (Improper Input Validation), the parent class that encompasses stored XSS (CWE-79): user-supplied input is insufficiently sanitized before being persisted and later rendered in the browser context, allowing script injection. The CPE string cpe:2.3:a:solarwinds:database_performance_analyzer:*:*:*:*:*:*:*:* uses a wildcard for the version field, indicating the flaw spans multiple releases. The adjacent-network attack vector (AV:A) reflects that DPA is typically deployed on internal management networks rather than exposed directly to the internet, consistent with SolarWinds' secure configuration guidance.

RemediationAI

Upgrade SolarWinds Database Performance Analyzer to version 2026.2 or later, as indicated by the DPA 2026.2 release notes available at https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2026-2_release_notes.htm; confirm the exact patched version via the vendor advisory at https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28322. As a compensating control prior to patching, restrict DPA administrative access to the smallest possible set of trusted accounts and enforce network segmentation so the DPA web interface is reachable only from a dedicated management VLAN, directly reducing the AV:A attack surface. Additionally, enforce strong authentication and session management for DPA accounts to limit the impact of any credential compromise that could enable payload injection. The SolarWinds Secure Configuration Guide at https://support.solarwinds.com/SuccessCenter/s/article/DPA-Secure-Configuration-Guide-Best-Practices-and-Recommendations provides supplemental hardening guidance. Note that network segmentation does not eliminate the stored XSS risk from insiders but does prevent external lateral movement into the DPA management plane.