[ CVE-2026-28331 · Published 20 Oct 2026 ]
Vulnerability in SolarWinds Patch Manager
CVSS 4.4
EPSS <1%1 agency advisoryFix available
[ Description ]Official description
SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges.
[ Fixes ]Fixes and patches
- Security bulletin: SolarWinds cve-2026-28331Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28331, cited by CERT-FR CERTFR-2026-AVI-1364
- Security bulletin: SolarWinds cve-2026-28328Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28328, cited by CERT-FR CERTFR-2026-AVI-1364
- Security bulletin: SolarWinds cve-2026-28329Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28329, cited by CERT-FR CERTFR-2026-AVI-1364
- Security bulletin: SolarWinds cve-2026-28330Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28330, cited by CERT-FR CERTFR-2026-AVI-1364
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1364
Multiple vulnerabilities in SolarWinds products Translated from French
Multiple vulnerabilities have been discovered in SolarWinds products. Some of them allow an attacker to cause privilege escalation, server-side request forgery (SSRF) and remote cross-site scripting (XSS).