Database Performance Analyzer CVE-2026-28322

Exploitation requires the attacker to hold high-privilege (PR:H) credentials within the SolarWinds DPA application - consistent with a database administrator or DPA admin role - sufficient to write to stored fields rendered in the web interface. The attacker must operate from an adjacent network segment (AV:A), meaning internet-based exploitation without prior network foothold is not possible. A victim DPA user must actively browse the page containing the injected payload (UI:R). High attack complexity (AC:H) indicates the exploit chain is non-trivial even under these conditions. Scope is unchanged (S:U), confining impact to the DPA application boundary. Exploitation is therefore not feasible in default, externally exposed configurations and is primarily a concern for organizations with untrusted or potentially malicious privileged DPA users on the internal management network.

The CVSS 3.1 vector (AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) with a base score of 5.6 accurately reflects a heavily gated exploit chain despite the high confidentiality and integrity impact. Adjacent network placement (AV:A) rules out internet-sourced attacks; the attacker must already occupy the same network segment as the DPA server. High privilege requirements (PR:H) mean the threat actor must possess administrative or equivalent DPA credentials before injecting the stored payload - substantially narrowing the attacker population to malicious insiders or those leveraging a prior credential compromise. High attack complexity (AC:H) and required user interaction (UI:R) add further barriers. No EPSS data was provided in the input, and there is no KEV listing or known POC, suggesting this has not been observed in the wild. In practical terms, this is a real but low-priority issue for most environments: the primary scenario is an insider with admin access targeting peer users' sessions. Organizations with strict role separation and network segmentation already significantly mitigate this.

A malicious database administrator or compromised high-privilege DPA account, operating from the internal management network, injects a JavaScript payload into a persistent DPA field such as an alert definition, dashboard label, or annotation. When a legitimate DPA user subsequently navigates to the page rendering that field, their browser silently executes the script, which could exfiltrate their session cookie to an attacker-controlled endpoint, enabling session hijacking without further credentials.