CVE-2026-28322 describes a stored cross-site scripting vulnerability in SolarWinds Database Performance Analyzer caused by improper input validation (CWE-20). This vulnerability allows an attacker with high privileges and user interaction to inject malicious scripts that execute in the context of the application. The CVSS vector indicates the attack requires adjacent network access, high attack complexity, high privileges, and user interaction, but can result in high confidentiality and integrity impact without affecting availability. No vendor advisory or patch information is currently available.

Successful exploitation can lead to the execution of malicious scripts within the application context, potentially compromising confidentiality and integrity of data handled by the SolarWinds Database Performance Analyzer. Availability is not impacted. The attack complexity and required privileges reduce the likelihood of exploitation but do not eliminate the risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit access to the affected application to trusted users and networks, and apply any recommended configuration changes from SolarWinds advisories once published.