SolarWinds Observability Self-Hosted CVE-2026-28330

Exploitation requires a valid authenticated account on the SolarWinds Observability Self-Hosted web interface (PR:L) with access to a feature that stores user-supplied input, plus a second authenticated victim who subsequently navigates to the affected page (UI:R) - the payload does not fire without that victim interaction. Limiting factors: the attacker cannot be fully unauthenticated, impact is confined to the browser session of users who view the stored content, and value is highest only when the victim is a higher-privileged user such as an administrator. The exact injectable feature/page is not named in the description, so defenders should consult the SolarWinds advisory and apply the Orion Platform 2026.4 release update and the vendor's secure-configuration guidance.

This is a moderate-severity stored XSS (CVSS 4.6, CWE-79) that should be treated as a routine, scheduled-patch priority rather than an emergency. The provided CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) signals that exploitation requires an authenticated attacker (PR:L) and that a victim must interact by visiting the affected page (UI:R), with only Low confidentiality and integrity impact and no availability impact. No EPSS score, KEV listing, or POC was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The signals are internally consistent: a network-reachable but privilege-gated, user-interaction-dependent web flaw with limited impact. The main caveat is a scope question - stored XSS executes in the context of other authenticated users' sessions, which arguably crosses a trust boundary (scope change) and is under-weighted by the vendor's S:U choice; this raises real-world impact modestly (session/UI manipulation of co-tenants/admins) but does not change the overall moderate priority. EPSS is absent rather than low, so no probabilistic exploitation inference can be made.

A low-privileged but authenticated SolarWinds Observability Self-Hosted user submits input into a field that is persistently stored and later rendered without sanitization. When a higher-privileged user (e.g., an administrator) views the affected page, the injected JavaScript executes in their authenticated session, enabling session-context actions, credential/token theft via the UI, or targeted defacement. No public exploit code was provided, so an attacker would need to identify the injectable field and craft the payload manually.