{"api_version":"1","generated_at":"2026-10-22T01:57:24+00:00","cve":"CVE-2026-28330","urls":{"html":"https://cve.report/CVE-2026-28330","api":"https://cve.report/api/cve/CVE-2026-28330.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-28330","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-28330"},"summary":{"title":"SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability","description":"SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.","state":"PUBLISHED","assigner":"SolarWinds","published_at":"2026-10-20 17:17:39","updated_at":"2026-10-20 19:59:00"},"problem_types":["CWE-79","CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":[{"version":"3.1","source":"psirt@solarwinds.com","type":"Secondary","score":"4.6","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"4.6","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","version":"3.1"}}],"references":[{"url":"https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htm","name":"https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htm","refsource":"psirt@solarwinds.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm","name":"https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm","refsource":"psirt@solarwinds.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28330","name":"https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28330","refsource":"psirt@solarwinds.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28330","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28330","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"SolarWinds","product":"SolarWinds Observability Self-Hosted","version":"affected 2026.2.3 and all previous versions","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"SolarWinds recommends customers to upgrade to Observability Self-Hosted version 2026.4 as soon as is practical.","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Dimitrios Titos from NATO","lang":"en"},{"source":"CNA","value":"Georgios Sotiriadis from NATO","lang":"en"},{"source":"CNA","value":"Frank Lycops from NATO","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-28330","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-20T18:19:21.668588Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-20T18:19:39.299Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"SolarWinds Observability Self-Hosted","vendor":"SolarWinds","versions":[{"status":"affected","version":"2026.2.3 and all previous versions"}]}],"credits":[{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"Dimitrios Titos from NATO"},{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"Georgios Sotiriadis from NATO"},{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"Frank Lycops from NATO"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.<br>"}],"value":"SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages."}],"impacts":[{"capecId":"CAPEC-592","descriptions":[{"lang":"en","value":"CAPEC-592 Stored XSS"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.6,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-20T16:23:19.940Z","orgId":"49f11609-934d-4621-84e6-e02e032104d6","shortName":"SolarWinds"},"references":[{"tags":["release-notes"],"url":"https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htm"},{"tags":["vendor-advisory"],"url":"https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28330"},{"tags":["x_secure-configuration-guide"],"url":"https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"SolarWinds recommends customers to upgrade to Observability Self-Hosted version 2026.4 as soon as is practical.<br>"}],"value":"SolarWinds recommends customers to upgrade to Observability Self-Hosted version 2026.4 as soon as is practical."}],"source":{"discovery":"EXTERNAL"},"title":"SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability","x_generator":{"engine":"Vulnogram 0.1.0-dev"}}},"cveMetadata":{"assignerOrgId":"49f11609-934d-4621-84e6-e02e032104d6","assignerShortName":"SolarWinds","cveId":"CVE-2026-28330","datePublished":"2026-10-20T16:23:19.940Z","dateReserved":"2026-02-26T14:47:03.211Z","dateUpdated":"2026-10-20T18:19:39.299Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-20 17:17:39","lastModifiedDate":"2026-10-20 19:59:00","problem_types":["CWE-79","CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":{"cvssMetricV31":[{"source":"psirt@solarwinds.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N","baseScore":4.6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.1,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-20T18:19:21.668588Z","id":"CVE-2026-28330","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"28330","Ordinal":"1","Title":"SolarWinds Observability Self-Hosted Cross-Site Scripting Vulner","CVE":"CVE-2026-28330","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"28330","Ordinal":"1","NoteData":"SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.","Type":"Description","Title":"SolarWinds Observability Self-Hosted Cross-Site Scripting Vulner"}]}}}