CVE-2026-28328
SolarWinds Observability Self-Hosted broken authorization schema
SolarWinds SolarWinds Observability Self-Hosted
CVSS
8.8HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.47%Chance of exploitation activity in the next 30 days, higher than 39% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.
Text from CVE List
Affected versions 1
- SolarWinds Observability Self-Hostedaffected: 2026.2.3 and all previous versionsCVE List
References 3
- solarwinds.com/trust-center/security-advisories/CVE-2026-28328Advisoryvia CVE List
- documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htmReferencevia CVE List
- documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmReferencevia CVE List