CVE-2025-26392
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
SolarWinds Observability Self-Hosted is susceptible to SQL injection that may display sensitive data using a low-level account. Requires authentication from a low-privilege account.
Risk Assessment
An attacker with low privileges can read sensitive data from the database, potentially leading to confidentiality breaches.
Recommendation
Apply vendor-provided patches and restrict user account privileges.
Other vulnerabilities in SolarWinds Observability Self-Hosted
See all- CVE-2026-28324Critical
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected.
- CVE-2026-28325High
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode.
Original NVD description (English source)
SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerability requires authentication from a low-privilege account.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS