CVE-2026-28330: SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability
SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SolarWinds Observability Self-Hostedto a version that resolves this vulnerability.Fixed in 2026.4
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Authenticated users who access pages containing attacker-injected content are exposed, because the stored script executes or is displayed in their browsers. Exploitation requires the attacker to have an authenticated account.
What does an attacker need to exploit it?
The attacker needs valid authenticated access and must be able to submit malicious content or JavaScript to an affected page. A victim must then access the page where that stored content is displayed.
Is user interaction required for impact?
Yes. Another authenticated user must access an affected page containing the stored malicious content for the XSS payload to be displayed or executed.