Stored Cross-Site Scripting Vulnerability in SolarWinds Observability Self-Hosted
CVE-2026-28330

4.6MEDIUM

Key Information:

Vendor

Solarwinds
Status
Solarwinds Observability Self-hosted
Vendor
CVE Published:
20 October 2026

What is CVE-2026-28330?

SolarWinds Observability Self-Hosted is susceptible to a stored Cross-Site Scripting (XSS) vulnerability that can be exploited by authenticated attackers. This flaw allows for the injection of malicious scripts or content, which can be executed in the browsers of other authenticated users accessing the affected pages. The exploitation poses a significant risk to user data and the overall integrity of the application.

Affected Version(s)

SolarWinds Observability Self-Hosted 2026.2.3 and all previous versions

References

https://documentation.solarwinds.com/en/success_center/or...
release-notes
https://www.solarwinds.com/trust-center/security-advisori...
vendor-advisory
https://documentation.solarwinds.com/en/success_center/or...
x_secure-configuration-guide

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dimitrios Titos from NATO
Georgios Sotiriadis from NATO
Frank Lycops from NATO
.