CVE-2026-28330

CVSS 4.6 (medium) · published 2026-10-20

SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages.

Weakness: CWE-79

Source: NVD CVE-2026-28330

References

• https://documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htm
• https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htm
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28330

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.