PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-28330 SolarWinds CVE debrief

A stored Cross-Site Scripting (XSS) vulnerability in SolarWinds Observability Self-Hosted allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages. This vulnerability requires verification of affected versions and potential impact, and defenders should prioritize updating to a fixed version and monitoring for suspicious activity. The CVE record and source item provide details about the vulnerability, but further verification is needed to determine the scope of affected versions and potential impact.

Vendor
SolarWinds
Product
SolarWinds Observability Self-Hosted
CVSS
MEDIUM 4.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-23
Advisory published
2026-10-20
Advisory updated
2026-10-23

Who should care

Defenders responsible for SolarWinds Observability Self-Hosted instances should assess exposure and prioritize verification and remediation efforts. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Defenders should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

Defenders should care about CVE-2026-28330 because it is a stored Cross-Site Scripting (XSS) vulnerability in SolarWinds Observability Self-Hosted, which allows authenticated attackers to inject malicious content or JavaScript. This vulnerability requires verification of affected versions and potential impact, and defenders should prioritize updating to a fixed version and monitoring for suspicious activity.

  • Potential injection of malicious content or JavaScript
  • Execution of malicious code in browsers of authenticated users
  • Possible disruption of service or data tampering
  • Need for verification of vulnerability and affected versions

Technical summary

The vulnerability is a stored Cross-Site Scripting (XSS) issue in SolarWinds Observability Self-Hosted, which allows authenticated attackers to inject malicious content or JavaScript. This vulnerability requires verification of affected versions and potential impact, and defenders should prioritize updating to a fixed version and monitoring for suspicious activity. The CVE record and source item provide details about the vulnerability, but further verification is needed to determine the scope of affected versions and potential impact.

Defensive priority

Defenders should prioritize verifying the vulnerability in their SolarWinds Observability Self-Hosted instances, especially if they have not updated to a fixed version.

Recommended defensive actions

  • Verify the vulnerability in SolarWinds Observability Self-Hosted instances
  • Check for updates to SolarWinds Observability Self-Hosted and apply if available
  • Monitor for suspicious activity on affected instances
  • Restrict access to affected pages for authenticated users
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details about the vulnerability, but the scope of affected versions and potential impact requires further verification. Defenders should verify the vulnerability in their SolarWinds Observability Self-Hosted instances, especially if they have not updated to a fixed version. The vulnerability is a stored Cross-Site Scripting (XSS) issue in SolarWinds Observability Self-Hosted, which allows authenticated attackers to inject malicious content or JavaScript. The source item and CVE record provide a 1

Sources and references

Verified primary and authoritative sources

  • CVE-2026-28330 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-28330

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-28330 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-28330

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/28xxx/CVE-2026-28330.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htm

    Supplemental source - release-notes

  • Source reference

    Unverified legacy reference

    URL: https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28330

    Supplemental source - vendor-advisory

  • Source reference

    Unverified legacy reference

    URL: https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm

    Supplemental source - x_secure-configuration-guide

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.