Solarwinds Observability Self-hosted — known CVE vulnerabilities

Every CVE whose affected-product data names Solarwinds Observability Self-hosted, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (8)

• CVE-2025-26397 — CVSS 7.8 (high): SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An…
• CVE-2025-26395 — CVSS 7.1 (high): SolarWinds Observability Self-Hosted was susceptible to a cross-site scripting (XSS) vulnerability due to an unsanitized field in the URL…
• CVE-2026-28297 — CVSS 6.1 (medium): SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can…
• CVE-2026-28298 — CVSS 5.9 (medium): SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can…
• CVE-2025-26392 — CVSS 5.4 (medium): SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level…
• CVE-2025-26391 — CVSS 5.4 (medium): SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects…
• CVE-2025-26394 — CVSS 4.8 (medium): SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an…
• CVE-2025-40545 — CVSS 4.8 (medium): SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an…