Vulnerability · Published Aug 12, 2025 · Assigned by SolarWinds

CVE-2025-26398SolarWinds Database Performance Analyzer Hard-coded Cryptographic Key Vulnerability

Medium 5.6

In plain English

A medium-severity hard-coded credentials in Database Performance Analyzer from SolarWinds. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)5.6Medium

Exploit odds (30 days)0.2%top 90.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machine-in-the-middle (MITM) attack against users. This vulnerability requires additional software not installed by default, local access to the server and administrator level privileges on the host.

Affected products (as reported)

Vendor	Product	Versions
SolarWinds	Database Performance Analyzer	2025.2 and below

Weakness: CWE-798 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

In plain English

Official description

Affected products (as reported)

References