Solarwinds Observability Self Hosted
Monthly
Broken authorization in SolarWinds Observability Self-Hosted allows an authenticated low-privileged user to access and modify information beyond their assigned permissions, with high confidentiality and integrity impact (CVSS 8.8). The flaw is network-reachable and requires only a valid low-privilege session, not pre-authentication, so a compromised or over-provisioned account is sufficient. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Stored cross-site scripting in SolarWinds Observability Self-Hosted allows authenticated users to store malicious JavaScript that is later rendered and executed in the browsers of other authenticated users who visit the affected page. Exploitation requires a valid low-privileged account and a second user who interacts with the stored content, so impact is generally limited to session-level actions and data exposure, with greater risk when the victim holds administrative privileges. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published the Orion Platform 2026.4 release update plus secure-configuration guidance.
This is a moderate-severity, authentication-gated server-side request forgery (SSRF) rather than a top-tier emergency: CVE-2026-28329 affects SolarWinds Observability Self-Hosted (CVSS 6.4) and requires a valid low-privileged authenticated session (PR:L). An attacker who can reach the vulnerable server-side request feature can make the application server send requests to attacker-controlled or internal destinations, which may expose otherwise firewalled services or cloud metadata endpoints; impact is limited by the authentication requirement and the server’s network reachability, and no public exploit or confirmed active exploitation was identified at time of analysis.
SolarWinds Observability Self-Hosted versions 2026.1.1 and earlier contain a stored cross-site scripting (XSS) vulnerability that permits authenticated high-privilege users to inject malicious scripts into the application, resulting in unintended script execution when other users access affected pages. The vulnerability requires high privilege level and user interaction to exploit, limiting real-world attack surface; no public exploit code or active exploitation has been identified at the time of analysis.
SolarWinds Observability Self-Hosted versions 2026.1.1 and earlier contain a stored cross-site scripting vulnerability that allows authenticated attackers with high privileges to inject malicious scripts into the application, resulting in unintended script execution within the security context of the affected system. The vulnerability requires administrative or high-privilege access and does not currently show evidence of active exploitation, though the ability to persist malicious payloads in stored data represents a significant insider threat. Affected organizations should prioritize patching to versions after 2026.1.1 to eliminate the XSS attack surface.
Broken authorization in SolarWinds Observability Self-Hosted allows an authenticated low-privileged user to access and modify information beyond their assigned permissions, with high confidentiality and integrity impact (CVSS 8.8). The flaw is network-reachable and requires only a valid low-privilege session, not pre-authentication, so a compromised or over-provisioned account is sufficient. No public exploit code or confirmed active exploitation was identified in the provided intelligence at time of analysis.
Stored cross-site scripting in SolarWinds Observability Self-Hosted allows authenticated users to store malicious JavaScript that is later rendered and executed in the browsers of other authenticated users who visit the affected page. Exploitation requires a valid low-privileged account and a second user who interacts with the stored content, so impact is generally limited to session-level actions and data exposure, with greater risk when the victim holds administrative privileges. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has published the Orion Platform 2026.4 release update plus secure-configuration guidance.
This is a moderate-severity, authentication-gated server-side request forgery (SSRF) rather than a top-tier emergency: CVE-2026-28329 affects SolarWinds Observability Self-Hosted (CVSS 6.4) and requires a valid low-privileged authenticated session (PR:L). An attacker who can reach the vulnerable server-side request feature can make the application server send requests to attacker-controlled or internal destinations, which may expose otherwise firewalled services or cloud metadata endpoints; impact is limited by the authentication requirement and the server’s network reachability, and no public exploit or confirmed active exploitation was identified at time of analysis.
SolarWinds Observability Self-Hosted versions 2026.1.1 and earlier contain a stored cross-site scripting (XSS) vulnerability that permits authenticated high-privilege users to inject malicious scripts into the application, resulting in unintended script execution when other users access affected pages. The vulnerability requires high privilege level and user interaction to exploit, limiting real-world attack surface; no public exploit code or active exploitation has been identified at the time of analysis.
SolarWinds Observability Self-Hosted versions 2026.1.1 and earlier contain a stored cross-site scripting vulnerability that allows authenticated attackers with high privileges to inject malicious scripts into the application, resulting in unintended script execution within the security context of the affected system. The vulnerability requires administrative or high-privilege access and does not currently show evidence of active exploitation, though the ability to persist malicious payloads in stored data represents a significant insider threat. Affected organizations should prioritize patching to versions after 2026.1.1 to eliminate the XSS attack surface.