Vulnerability in SolarWinds Observability Self-Hosted

[ Description ]Official description

SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.

[ Fixes ]Fixes and patches

• Security bulletin: SolarWinds cve-2026-28331Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28331, cited by CERT-FR CERTFR-2026-AVI-1364
• Security bulletin: SolarWinds cve-2026-28328Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28328, cited by CERT-FR CERTFR-2026-AVI-1364
• Security bulletin: SolarWinds cve-2026-28329Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28329, cited by CERT-FR CERTFR-2026-AVI-1364
• Security bulletin: SolarWinds cve-2026-28330Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28330, cited by CERT-FR CERTFR-2026-AVI-1364

[ Advisories ]Government CERT advisories

• CERT-FR22 Oct 2026CERTFR-2026-AVI-1364

  Multiple vulnerabilities in SolarWinds products Translated from French

  Multiple vulnerabilities have been discovered in SolarWinds products. Some of them allow an attacker to cause privilege escalation, server-side request forgery (SSRF) and remote cross-site scripting (XSS).

  CVE-2026-28331CVE-2026-28330CVE-2026-28328+3 more CVEs

[ References ]References

• documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-config…
• documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_…
• www.solarwinds.com/trust-center/security-advisories/CVE-2026-28330