CVE-2026-28328— SolarWinds Observability Self-Hosted broken authorization schema
Quick assessment
Affected
SolarWinds SolarWinds Observability Self-Hosted
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SolarWinds Observability Self-Hosted 被发现存在授权机制缺陷，该缺陷允许低权限用户访问并修改超出其授权范围的信息。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-28328
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SolarWinds Observability Self-Hosted broken authorization schema
Source: CVE Program / CVE List V5
Vulnerability Description
SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SolarWinds | SolarWinds Observability Self-Hosted | 2026.2.3 and all previous versions | - |
|
II. Public POCs for CVE-2026-28328
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-28328
请登录查看更多情报信息。
Other References for CVE-2026-28328 (2)
Same Patch Batch · SolarWinds · 2026-10-20 · 4 CVEs total
| CVE-2026-28329 | 6.4 MEDIUM | SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF) |
| CVE-2026-28330 | 4.6 MEDIUM | SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability |
| CVE-2026-28331 | 4.4 MEDIUM | SolarWinds Patch Manager Sensitive Information Exposure Vulnerability |
IV. Related Vulnerabilities
Same product: SolarWinds Observability Self-Hosted
-
CVE-2026-28330
SolarWinds Observability Self-Hosted Cross-Site Scripting Vu -
CVE-2026-28329
SolarWinds Observability Self-Hosted Server-Side Request For -
CVE-2026-28298
SolarWinds Observability Self-Hosted Stored Cross-Site Scrip -
CVE-2026-28297
SolarWinds Observability Self-Hosted Stored Cross-Site Scrip -
CVE-2025-40545
SolarWinds Observability Self-Hosted Open Redirection Vulner
Same vendor: SolarWinds
-
CVE-2026-28330
SolarWinds Observability Self-Hosted Cross-Site Scripting Vu -
CVE-2026-28329
SolarWinds Observability Self-Hosted Server-Side Request For -
CVE-2026-28331
SolarWinds Patch Manager Sensitive Information Exposure Vuln -
CVE-2026-28325
SolarWinds Observability Self-Hosted Unauthenticated Remote -
CVE-2026-28324
SolarWinds Observability Self-Hosted Remote Code Execution V
Same weakness: CWE-863
-
CVE-2026-113670
ApostropheCMS: Page REST API authorization bypass -
CVE-2026-113653
ApostropheCMS: The general public can access @apostrophecms/ -
CVE-2026-112956
ApostropheCMS: Archive duplicate continuation lets contribut -
CVE-2026-113676
Froxlor 0.10.0 before 2.3.15 Authorization Bypass via Admins -
CVE-2026-113611
Outline before 1.8.0 Information Disclosure via Orphaned Web
V. Comments for CVE-2026-28328
No comments yet