Vulnerability in SolarWinds Observability Self-Hosted

[ Description ]Official description

SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations.

[ Fixes ]Fixes and patches

• Security bulletin: SolarWinds cve-2026-28331Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28331, cited by CERT-FR CERTFR-2026-AVI-1364
• Security bulletin: SolarWinds cve-2026-28328Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28328, cited by CERT-FR CERTFR-2026-AVI-1364
• Security bulletin: SolarWinds cve-2026-28329Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28329, cited by CERT-FR CERTFR-2026-AVI-1364
• Security bulletin: SolarWinds cve-2026-28330Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28330, cited by CERT-FR CERTFR-2026-AVI-1364

[ Advisories ]Government CERT advisories

• CERT-FR22 Oct 2026CERTFR-2026-AVI-1364

  Multiple vulnerabilities in SolarWinds products Translated from French

  Multiple vulnerabilities have been discovered in SolarWinds products. Some of them allow an attacker to cause privilege escalation, server-side request forgery (SSRF) and remote cross-site scripting (XSS).

  CVE-2026-28331CVE-2026-28330CVE-2026-28328+3 more CVEs

[ References ]References

• documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-config…
• documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_…
• www.solarwinds.com/trust-center/security-advisories/CVE-2026-28329