Medium severity · published Oct 20, 2026
CVE-2026-28330
SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability
4.6
CVSS
0.3%
EPSS
No
On KEV
Description
SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
SolarWinds Observability Self-Hosted · SolarWinds
2026.2.3 and all previous versions · source: vendor
Affected product
SO
SolarWinds Observability Self-Hosted
SolarWinds
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-28330
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-28330
documentation.solarwinds.com
https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm
documentation.solarwinds.com
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htm
www.solarwinds.com
https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28330
More from SolarWinds Observability Self-Hosted
8.8
CVE-2026-28328
SolarWinds Observability Self-Hosted broken authorization schema
8.7
CVE-2026-28297
SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability
8.1
CVE-2026-28298
SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability
6.4
CVE-2026-28329
SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF)
5.4
CVE-2025-26391
SolarWinds Observability Self-Hosted XSS Vulnerability