CVE-2026-28322 describes a stored cross-site scripting vulnerability in SolarWinds Database Performance Analyzer caused by improper input validation (CWE-20). This vulnerability allows an attacker to inject malicious scripts that are stored and later executed in the context of the application, potentially leading to unauthorized actions or data exposure. The CVSS vector indicates the attack requires high privileges and user interaction, with network attack vector and high impact on confidentiality and integrity but no impact on availability. No vendor advisory or patch information is currently available.

Successful exploitation can lead to the execution of malicious scripts within the application context, compromising confidentiality and integrity of data handled by the SolarWinds Database Performance Analyzer. The vulnerability does not impact availability. The attack requires high privileges and user interaction, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application to trusted users only and apply input validation controls where possible to mitigate risk.