Description
SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SolarWinds | SolarWinds Observability Self-Hosted | 2026.2.3 and all previous versions | — |
Advisories 5
- WID-SEC-2026-4117 Node.js: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- WID-SEC-2026-4162 Microsoft .NET und ASP.NET: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-1719 Erlang/OTP: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 27, 2026
- WID-SEC-2026-1201 Oracle Java SE: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 27, 2026
- WID-SEC-2026-4190 SolarWinds Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 27, 2026
References
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htm release-notes
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28330 vendor-advisory
- https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm