CVE-2026-28331— SolarWinds Patch Manager Sensitive Information Exposure Vulnerability
Quick assessment
Affected
SolarWinds Patch Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SolarWinds Patch Manager 存在敏感信息泄露漏洞，本地用户可访问这些信息，进而可能被利用以获取更高权限。
Possible ATT&CK Techniques 2 AI
T1548 · Abuse Elevation Control Mechanism T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-28331
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
SolarWinds Patch Manager Sensitive Information Exposure Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SolarWinds | Patch Manager | 2026.2 and all previous versions | - |
|
II. Public POCs for CVE-2026-28331
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-28331
请登录查看更多情报信息。
Other References for CVE-2026-28331 (2)
Same Patch Batch · SolarWinds · 2026-10-20 · 4 CVEs total
| CVE-2026-28328 | 8.8 HIGH | SolarWinds Observability Self-Hosted broken authorization schema |
| CVE-2026-28329 | 6.4 MEDIUM | SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF) |
| CVE-2026-28330 | 4.6 MEDIUM | SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability |
IV. Related Vulnerabilities
Same vendor: SolarWinds
-
CVE-2026-28330
SolarWinds Observability Self-Hosted Cross-Site Scripting Vu -
CVE-2026-28329
SolarWinds Observability Self-Hosted Server-Side Request For -
CVE-2026-28328
SolarWinds Observability Self-Hosted broken authorization sc -
CVE-2026-28325
SolarWinds Observability Self-Hosted Unauthenticated Remote -
CVE-2026-28324
SolarWinds Observability Self-Hosted Remote Code Execution V
Same weakness: CWE-200
-
CVE-2026-111756
follow-redirects array-form headers bypass cross-origin cred -
CVE-2026-113668
ApostropheCMS: :_id/locales REST route omits the public-API -
CVE-2026-113652
ApostropheCMS uploadfs Azure backend leaks account-level SAS -
CVE-2026-112954
ApostropheCMS: Unauthenticated publicApiProjection bypass vi -
CVE-2026-112953
ApostropheCMS: Exposure of Sensitive Information via predict
V. Comments for CVE-2026-28331
No comments yet