Medium · 5.9 CVE-2026-28298 EUVD-2026-16185GHSA-c2f7-jh9g-224w

SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability

Published Mar 26, 2026 · Updated Mar 27, 2026 · Assigned by SolarWinds

Vendor: SolarWinds Product: SolarWinds Observability Self-Hosted

Description

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.

Affected products

Vendor	Product	Affected	Fixed
SolarWinds	SolarWinds Observability Self-Hosted	2026.1.1 and previous versions	—

Advisories 1

WID-SEC-2026-0869 SolarWinds Platform: Mehrere Schwachstellen ermöglichen Cross-Site Scripting BSI CERT-Bund (WID) · Mar 26, 2026

References

https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28298
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-1-1_release_notes.htm