Detections
Analytics
SolarWinds Observability Self-Hosted < 2026.4 Multiple Vulnerabilities
high Nessus Plugin ID 371218
Language:
Synopsis
An application installed on the remote Windows host is affected by multiple vulnerabilities.Description
The version of SolarWinds Observability Self-Hosted installed on the remote host is prior to 2026.4. It is, therefore, affected by multiple vulnerabilities:- A broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions. (CVE-2026-28328)
- A server-side request forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations. (CVE-2026-28329)
- A stored cross-site scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages. (CVE-2026-28330)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to SolarWinds Observability Self-Hosted version 2026.4 or later.See Also
http://www.nessus.org/u?2cf3ca40
http://www.nessus.org/u?75d9880c
Plugin Details
Severity: High
ID: 371218
File Name: solarwinds_observability_self_hosted_2026_4.nasl
Version: 1.1
Type: Combined
Agent: windows
Family: CGI abuses
Published: 10/23/2026
Updated: 10/23/2026
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 58.48
CVSS v2
Risk Factor: High
Base Score: 9
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2026-28328
CVSS v3
Risk Factor: High
Base Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability Information
CPE: cpe:/a:solarwinds:orion_platform
Required KB Items: installed_sw/SolarWinds Orion Core
Patch Publication Date: 10/20/2026
Vulnerability Publication Date: 10/20/2026