CVE-2026-28328: SolarWinds Observability Self-Hosted broken authorization schema
Published Oct 20, 2026
·Updated
SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.
Affected Software
1 affected component
SolarWinds Observability Self-Hosted
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SolarWinds Observability Self-Hostedto a version that resolves this vulnerability.Fixed in 2026.4
Event History
Oct 20, 2026
CVE Published
via MITRE·04:17 PM
Data Sourced
via MITRE·04:17 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The vulnerability requires low-privileged access to SolarWinds Observability Self-Hosted. It does not require the attacker to have administrative permissions.
2
Can this be exploited remotely without user interaction?
The CVSS vector indicates network-based exploitation with low attack complexity and no user interaction required. Successful exploitation can affect confidentiality, integrity, and availability.