CVE-2026-28330: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in SolarWinds SolarWinds Observability Self-Hosted
Description
SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.
CVSS v3.1
Score 4.6medium
Affected software
SolarWinds
SolarWinds Observability Self-Hosted
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-28330 is a stored Cross-Site Scripting (XSS) vulnerability in SolarWinds Observability Self-Hosted. Authenticated attackers can inject malicious content or JavaScript into the application, which is then rendered and executed in the browsers of other authenticated users accessing the affected pages. This improper neutralization of input during web page generation can lead to limited confidentiality and integrity impacts. The vulnerability requires authentication and user interaction (UI:R).
Potential Impact
An authenticated attacker can inject malicious scripts that execute in other users' browsers, potentially leading to limited confidentiality and integrity compromise. There is no reported impact on availability. The CVSS score of 4.6 reflects a medium severity level.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit access to trusted users and monitor for suspicious activity related to script injection.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- SolarWinds
- Date Reserved
- 2026-02-26T14:47:03.211Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad79b8c2cdf04f65643a7b8
Added to database: 10/20/2026, 16:49:16 UTC
Last enriched: 10/20/2026, 17:03:20 UTC
Last updated: 10/20/2026, 19:06:08 UTC
Views: 11
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.