CVE-2026-28330
CVE-2026-28330 · SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability
This page contains facts from public vulnerability sources. Check the original advisory before updating.
SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.
CVSS 4.6 · Medium · EPSS 0.4%
- Published
- Updated
Affected products and versions
solarwinds observability self-hosted
- Versions
- 2026.2.3 and all previous versions: Affected
No fix published
Original sources
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28330
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm
- https://nvd.nist.gov/vuln/detail/CVE-2026-28330