Observability Self Hosted
Monthly
Unauthenticated remote code execution in SolarWinds Observability Self-Hosted (CVSS 8.8) allows attackers on an adjacent network to execute arbitrary code via deserialization of untrusted data, but only when the deployment is configured to use a specific non-default communication mode. Default-configured instances are not exploitable, and the adjacent-network attack vector (AV:A) further narrows the exposed population. No public exploit code has been identified at time of analysis, and no credentials or user interaction are required once the mode is enabled and reachable.
Unauthenticated remote code execution affects SolarWinds Observability Self-Hosted installations that are running in a non-default and non-secure configuration, allowing an attacker who can reach the service to execute arbitrary code with no credentials and no user interaction. The root cause is insufficient integrity checking (CWE-345): when the insecure configuration is present, integrity validation that would otherwise block attacker-supplied content is weakened or bypassed. SolarWinds scores the issue 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but that base score does not reflect the environmental gate - default and hardened deployments are not exploitable, so real-world exposure is confined to operators who have deviated from the vendor's documented secure-configuration guidance; no public exploit code or confirmed active exploitation was identified at time of analysis.
Open redirect in SolarWinds Observability Self-Hosted enables an authenticated low-privilege attacker on an adjacent network segment to supply a crafted external URL that redirects application traffic or users to an attacker-controlled site. The CVSS vector assigns High confidentiality impact (C:H) despite a medium overall score of 4.8, suggesting the redirect may expose sensitive data - such as session tokens or credentials - to the attacker-controlled destination, rather than being a simple phishing-only vector. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis. SolarWinds has released a patch in the HCO 2026.2 release.
SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. Rated medium severity (CVSS 4.8). No vendor patch available.
SolarWinds Observability Self-Hosted XSS Vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is low attack complexity. No vendor patch available.
Authenticated SQL injection in SolarWinds Observability Self-Hosted allows an attacker holding a low-privilege account to read data beyond that account's authorization by supplying crafted input to a SQL-injectable field in the application. The vendor rates this CVSS 4.6 (AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), reflecting limited confidentiality and integrity impact rather than full database compromise or service disruption; our independent assessment keeps the same low-privilege authentication prerequisite and limited confidentiality impact, but raises the attack vector to network-reachable (AV:N) and treats integrity impact as none, since the practical outcome is information disclosure. Vendor patches are available, and no public exploit code has been identified at time of analysis - the risk profile is a low-to-moderate priority requiring an already-obtained credential rather than an urgent, remotely exploitable flaw.
Stored/reflected cross-site scripting (XSS) vulnerability in SolarWinds Observability Self-Hosted caused by insufficient input sanitization in URL parameters. The vulnerability affects authenticated administrators and requires user interaction to exploit, allowing attackers with admin credentials to inject malicious scripts that execute in victim browsers with network-scoped impact (C:H, I:L, A:L). There is no indication of active exploitation in the wild (KEV status unknown) or public proof-of-concept availability based on available data.
SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required.
Unauthenticated remote code execution in SolarWinds Observability Self-Hosted (CVSS 8.8) allows attackers on an adjacent network to execute arbitrary code via deserialization of untrusted data, but only when the deployment is configured to use a specific non-default communication mode. Default-configured instances are not exploitable, and the adjacent-network attack vector (AV:A) further narrows the exposed population. No public exploit code has been identified at time of analysis, and no credentials or user interaction are required once the mode is enabled and reachable.
Unauthenticated remote code execution affects SolarWinds Observability Self-Hosted installations that are running in a non-default and non-secure configuration, allowing an attacker who can reach the service to execute arbitrary code with no credentials and no user interaction. The root cause is insufficient integrity checking (CWE-345): when the insecure configuration is present, integrity validation that would otherwise block attacker-supplied content is weakened or bypassed. SolarWinds scores the issue 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but that base score does not reflect the environmental gate - default and hardened deployments are not exploitable, so real-world exposure is confined to operators who have deviated from the vendor's documented secure-configuration guidance; no public exploit code or confirmed active exploitation was identified at time of analysis.
Open redirect in SolarWinds Observability Self-Hosted enables an authenticated low-privilege attacker on an adjacent network segment to supply a crafted external URL that redirects application traffic or users to an attacker-controlled site. The CVSS vector assigns High confidentiality impact (C:H) despite a medium overall score of 4.8, suggesting the redirect may expose sensitive data - such as session tokens or credentials - to the attacker-controlled destination, rather than being a simple phishing-only vector. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis. SolarWinds has released a patch in the HCO 2026.2 release.
SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. Rated medium severity (CVSS 4.8). No vendor patch available.
SolarWinds Observability Self-Hosted XSS Vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is low attack complexity. No vendor patch available.
Authenticated SQL injection in SolarWinds Observability Self-Hosted allows an attacker holding a low-privilege account to read data beyond that account's authorization by supplying crafted input to a SQL-injectable field in the application. The vendor rates this CVSS 4.6 (AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), reflecting limited confidentiality and integrity impact rather than full database compromise or service disruption; our independent assessment keeps the same low-privilege authentication prerequisite and limited confidentiality impact, but raises the attack vector to network-reachable (AV:N) and treats integrity impact as none, since the practical outcome is information disclosure. Vendor patches are available, and no public exploit code has been identified at time of analysis - the risk profile is a low-to-moderate priority requiring an already-obtained credential rather than an urgent, remotely exploitable flaw.
Stored/reflected cross-site scripting (XSS) vulnerability in SolarWinds Observability Self-Hosted caused by insufficient input sanitization in URL parameters. The vulnerability affects authenticated administrators and requires user interaction to exploit, allowing attackers with admin credentials to inject malicious scripts that execute in victim browsers with network-scoped impact (C:H, I:L, A:L). There is no indication of active exploitation in the wild (KEV status unknown) or public proof-of-concept availability based on available data.
SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required.