SolarWinds DPA 2026.2 Multiple Vulnerabilities Advisory (CVEs)

Vulnerability Overview Several security vulnerabilities exist in SolarWinds Database Performance Analyzer (DPA) version 2026.2, including vulnerabilities within SolarWinds' own products and in third-party components. Affected Scope SolarWinds CVEs CVE-2026-28322: Stored Cross-Site Scripting (XSS) vulnerability in SolarWinds Database Performance Analyzer. This vulnerability allows attackers to execute malicious scripts through a stored XSS flaw, potentially leading to unauthorized script execution. Third-Party CVEs CVE-2026-34487: Sensitive information insertion into log files in the Apache Tomcat Cloud Membership Cluster component. This vulnerability affects Apache Tomcat versions from 11.0.0-M1 to 11.0.20 and from 10.1.0-M1 to 10.1.53. CVE-2026-43515: Improper authorization vulnerability in Apache Tomcat. This vulnerability affects Apache Tomcat versions from 11.0.0-M1 to 11.0.21, from 10.1.0-M1 to 10.1.54, from 9.0.0.M1 to 9.0.117, from 8.5.0 to 8.5.100, and from 7.0.0 to 7.0.109. CVE-2025-53864: Vulnerability in Connect2Id Nimbus JOSE + JWT service. This vulnerability affects Connect2Id Nimbus JOSE + JWT versions prior to 10.0 and prior to 9.37.x. CVE-2025-52999: Stack overflow vulnerability in Jackson-core. This vulnerability affects Jackson-core versions 2.15.0 and later. Remediation SolarWinds CVEs CVE-2026-28322: Upgrade to the latest version of SolarWinds Database Performance Analyzer. Third-Party CVEs CVE-2026-34487: Upgrade to Apache Tomcat versions 11.0.21, 10.1.54, or 9.0.117. CVE-2026-43515: Upgrade to Apache Tomcat versions 11.0.21, 10.1.54, 9.0.117, 8.5.100, or 7.0.109. CVE-2025-53864: Upgrade to Connect2Id Nimbus JOSE + JWT version 10.0.2 or 9.37.x. CVE-2025-52999: Upgrade to Jackson-core version 2.15.0 or later, and avoid parsing JSON input files from untrusted sources. Code Blocks No specific POC (Proof of Concept) code or exploitation code is included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

SolarWinds DPA 2026.2 Multiple Vulnerabilities Advisory (CVEs)