SolarWinds Patch Manager CVE-2026-28331

Requires the attacker to already have LOCAL access to the host running SolarWinds Patch Manager (AV:L) and, per the stated CVSS vector, existing HIGH privileges (PR:H); no user interaction is needed (UI:N). The flaw exposes sensitive information to local users that can then be used for privilege escalation. Limiting factors: there is no remote vector, so network-only attackers cannot reach it directly, and the attacker must first establish a local foothold. Note: the description's 'gain elevated privileges' phrasing suggests the practical precondition may be a lower-privileged local account (PR:L) rather than PR:H - defenders should confirm with the vendor advisory, as that materially changes the barrier to exploitation. The specific files, registry keys, or product feature exposing the data are not named in the available data.

This is a low-to-moderate priority issue despite the sensitive nature of information disclosure. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, base 4.4) indicates a LOCAL attack vector requiring HIGH privileges (PR:H) already on the host, with only confidentiality impact (C:H) and no integrity or availability effect. The description's framing - 'accessible to local users, which could be used to gain elevated privileges' - implies the disclosed data is a stepping stone to privilege escalation rather than a direct compromise. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or imminent exploitation. There is a mild internal tension worth verifying: the vector asserts PR:H (attacker already holds high privileges) while the description's value proposition is 'gain elevated privileges,' which normally implies the attacker starts with LOWER privilege (PR:L) - verify the intended privilege precondition with SolarWinds, as PR:L would raise the realistic risk. Overall this is a high-severity-of-data but low-real-world-urgency flaw: local access and existing privilege are prerequisites, and no exploitation evidence exists.

A local user or an attacker who has already obtained an authenticated foothold on a server running SolarWinds Patch Manager reads sensitive information (e.g., credentials or configuration secrets) exposed to local accounts. They then leverage that disclosed data to escalate to higher privileges on the host. No public exploit code was identified in the provided data, and exploitation requires prior local access.