Vulnerability · Published Oct 20, 2026 · Assigned by SolarWinds
CVE-2026-28330SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability
Medium 4.6
In plain English
A medium-severity cross-site scripting in SolarWinds Observability Self-Hosted from SolarWinds. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)4.6Medium
Exploit odds (30 days)0.3%top 79.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SolarWinds | SolarWinds Observability Self-Hosted | 2026.2.3 and all previous versions |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
References
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htm release-notes
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28330 vendor-advisory
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm x_secure-configuration-guide